1. A method for discovering a set of applications that run on a network comprising: determining aggregate traffic volumes for pairs of nodes on the network over a plurality of time intervals; building a traffic matrix denoting each of the pairs of nodes and denoting respective aggregate traffic volume histories of each of the pairs of nodes that are based on the determined traffic volumes, wherein the traffic matrix is formulated as a combination of bases vectors that model the set of applications; determining, by a processor, the bases vectors by applying a covariance matrix adaptation evolutionary strategy (CMA-ES) based on the traffic matrix; and outputting an indication of the set of applications that is based on the bases vectors.