1. A method for extracting at least one data field from a stream of data received from a network, comprising: inputting at least one positive example of an instance of the at least one data field; and based on the at least one positive example, analyzing the stream of data received from the network to determine a first result set including at least one candidate for the at least one data field in the stream, wherein the analyzing is based on no knowledge or only partial knowledge of any protocol represented by the stream received from the network.