Disclosed herein are systems and methods for multi-level classification of data traffic flows based in part on information in a first data packet for a data traffic flow. In exemplary embodiments of the present disclosure, a key can be generated to track data traffic flows by application names and data packet information or properties. Based in part on these keys, patterns can be discerned to infer data traffic information based on only the information in a first data packet. The determined patterns can be used to predict classifications of future traffic flows with similar key information. In this way, data traffic flows can be classified and steered in a network based on limited information available in a first data packet.