Aspects of the subject disclosure may include, for example, a processing system that performs operations including collecting encrypted network traffic flow data from user interaction with an application, deriving a first set of traffic feature vectors from the encrypted network traffic flow data collected, training a machine learning algorithm on the first set of traffic feature vectors to classify each traffic feature vector in the first set of traffic feature vectors as associated with a type of the application or not associated with the type of the application, and classifying whether an encrypted network traffic flow as the type of the application by applying the machine learning algorithm to a traffic feature vector of the encrypted network traffic flow. Other embodiments are disclosed.