Systems and methods for classifying a traffic flow on a network to determine a policy are described herein. The systems and methods enable a network to use aspects of an encrypted traffic flow and compare those aspects against a training set of data to classify the traffic flow. The classification helps the network determine and enforce policies associated with traffic flows from various services, even if the traffic flows are encrypted (obfuscated).