Systems and methods for detecting application behavior using network traffic are described herein. The systems and methods enable a network to utilize network traffic data to determine various metrics and behavioral patterns associated with applications and their use. The patterns can be used to monitor traffic from a specific user device and across the network. Further, the information may be used to generate a trust score that provides a network and/or a user with information relating to an application.