1. A method for detecting an altered application, the method comprising: obtaining, by a processor, network traffic data for a plurality of endpoint devices to determine a network traffic signature for a first application, wherein the network traffic signature for the first application comprises a set of flows within a time window; monitoring, by the processor, the network traffic data to determine a network traffic signature for a second application, wherein the network traffic signature for the second application comprises the network traffic signature of the first application plus a flow to an additional address that is not included in the set of flows of the network traffic signature of the first application; determining, by the processor, a percentage of a number of endpoint devices using the second application versus a total number of endpoint devices using the first application and the second application; and determining, by the processor, that the second application is the altered application comprising an altered version of the first application when the percentage satisfies a threshold.