Network flow classification can include clustering a network flow database into a number of at least one of applications and network flows. Network flow classification can include classifying the number of the at least one of applications and network flows.
Please help me write a proper abstract based on the patent claims. CLAIM: 1. A system, comprising: a cluster engine to cluster a number of applications within a network into a number of clusters; a learning engine to learn a signature for each of the number of applications based on the number of clusters; and a flow detection engine to classify each of the number of applications based on the learned signatures. 2. The system of claim 1, the flow detection engine to classify each of the number of applications as a new application or an existing application based on the learned signatures, 3. The system of claim 1, the flow detection engine to classify a first one of the number of applications as a new application in response to a determined distance between the first one of the applications and a particular cluster being greater than a threshold distance, 4. The system of claim 1, the flow detection engine to classify a first one of the number of applications as an existing application in response to a determined distance between the first one of the number of applications and a particular cluster being less than a threshold distance. 5. The system of claim 1, the cluster engine to auto-learn the number of clusters, the size of each of the number of clusters, and the shape of each of the number of clusters. 6. The system of claim 1, the cluster engine to cluster the number of applications using an unsupervised clustering approach on at least one of an existing network flow database and a real-time network flow capture system. 7. A non-transitory machine readable medium storing instructions executable by a processing resource to cause a computer to: cluster a network flow database into a number of clusters of network flows; detect a network flow that is not within any one of the number of clusters of network flows; calculate a distance between the network flow and each of the number of clusters; and classify the network flow based on each of the calculated distances. 8. The non-transitory machine readable medium of claim 7, including instructions executable to determine a threshold distance, wherein the classification of the network flow is based on whether or not the distance between the network flow and each of the number of clusters falls within the threshold distance. 9. The non-transitory machine readable medium of claim 7, wherein the instructions executable to cluster the network flow database include instructions executable to cluster the network flow database into a number of clusters of network flows to learn a signature of an application, wherein the application is associated with a network flow within the number of clusters of network flows. 10. The non-transitory machine readable medium of claim 7, wherein the instructions executable to cluster the network flow database include instructions executable to iteratively cluster the network flow database until a termination criterion is met. 11. The non-transitory machine readable medium of claim 10, wherein the termination criterion includes at least one of all flows within the network flow database is clustered and all viable clusters are formed. 12. A method, comprising: clustering a network flow database into a particular number of clusters of network flows; determining a threshold cluster size and removing any of the number of clusters having a size greater than the threshold cluster size; detecting a network flow that falls outside of each of the particular number of clusters of network flows; computing a distance between the network flow and a centroid of each of the particular number of clusters of network flows; and classifying the network flow as a new network flow or an existing network flow based on the distance. 13. The method of claim 12, including creating a residual database that include the any of the number of clusters having a size greater than the threshold cluster size. 14. The method of claim 12, including periodically expanding the threshold cluster size to accommodate nearby network flows. 15. The method of claim 12, wherein classifying the network flow includes: classifying the network flow as new in response to the distance falling outside the threshold cluster size; and classifying the network flow as existing in response to the distance falling within the threshold cluster size.