1. A method of classifying network traffic comprising: performing processing associated with monitoring, with a domain identification module in communication with a processor circuit and a network, network traffic; performing processing associated with comparing, with a traffic classification module in communication with the processor circuit and the domain identification module, the network traffic with a control protocol template (CPT) stored in a database in communication with the domain identification module and the processor circuit; when a similarity between the monitored traffic and the CPT exceeds a match threshold, performing processing associated with associating, with the domain identification module, the monitored traffic with the CPT; and when the similarity between the monitored traffic and the CPT does not exceed the match threshold, performing processing associated with identifying, with the traffic classification module, the monitored traffic as having an unknown classification.