1. A computer-implemented method comprising: establishing, between a first wide are network (WAN) acceleration device operable at an edge of a first subnet of an enterprise network and a second WAN acceleration device operable at an edge of a second subnet of the enterprise network, a private tunnel, wherein the private tunnel is used by the first and second WAN acceleration devices to convey application layer data for a particular connection-oriented application layer protocol of a plurality of connection-oriented application layer protocols known to behave poorly within a WAN environment and that are capable of being accelerated by the first and second WAN acceleration devices; receiving, by a flow classification module executing on the first WAN acceleration device at an Internet Protocol (IP) layer of a protocol stack of the first WAN acceleration device, packets from the second WAN acceleration device via the private tunnel; passing, by the flow classification module, the packets to a transport layer of the protocol stack via a WAN socket executing on the first WAN acceleration device at the transport layer, wherein the WAN socket represents an interface between the first and second WAN acceleration devices for connection-oriented application layer protocol traffic; based on the particular application layer protocol with which the packets are associated, passing, by the WAN socket, the packets to an application handler of a plurality of application handlers executing on the first WAN acceleration device at an application layer of the protocol stack, each of the plurality of application handlers implementing one or more application acceleration techniques for an associated application layer protocol of the plurality of connection-oriented application layer protocols; and securely accelerating the connection-oriented application layer protocol traffic, by the application handler, by performing the one or more application acceleration techniques, classifying data streams into different stages including tagging a data stream as being at a stage in which associated data is unlikely repeatable, repeatable but not stable or stable and applying one or more security functions.