15. A non-transitory computer readable medium embodying instructions for identifying a network application, the instructions when executed by a processor comprising functionally for: analyzing a source code of a network application, among a plurality of network applications, to extract a plurality of source code tokens; generating an index document of the network application based on the plurality of source code tokens, wherein the index document is included in a plurality of index documents corresponding to the plurality of network applications, the plurality of index documents being loaded as a corpus into a search engine; extracting a plurality of packet header tokens from a packet header of a packet in a flow to generate one or more query documents; comparing, using the search engine, the plurality of packet header tokens of the one or more query documents to the plurality of packet header tokens to the plurality of index documents to generate a plurality of match scores, wherein each of the plurality of match scores represents a similarity measure between the plurality of packet header tokens and one of the plurality of index documents; and determining, based at least on a match score of the plurality of match scores and corresponding to the network application, that the flow is generated by the network application.
15. A non-transitory computer readable medium embodying instructions for identifying a network application, the instructions when executed by a processor comprising functionally for: analyzing a source code of a network application, among a plurality of network applications, to extract a plurality of source code tokens; generating an index document of the network application based on the plurality of source code tokens, wherein the index document is included in a plurality of index documents corresponding to the plurality of network applications, the plurality of index documents being loaded as a corpus into a search engine; extracting a plurality of packet header tokens from a packet header of a packet in a flow to generate one or more query documents; comparing, using the search engine, the plurality of packet header tokens of the one or more query documents to the plurality of packet header tokens to the plurality of index documents to generate a plurality of match scores, wherein each of the plurality of match scores represents a similarity measure between the plurality of packet header tokens and one of the plurality of index documents; and determining, based at least on a match score of the plurality of match scores and corresponding to the network application, that the flow is generated by the network application. 16. The non-transitory computer readable medium of claim 15 , wherein extracting the plurality of source code tokens comprises: extracting, from the source code of the network application, a plurality of universal resource locator (URL) strings and a plurality of key declaration strings; and further extracting a plurality of domain host names, a plurality of universal resource identifier (URI) path strings, and a first plurality of keys from the plurality of URL strings, as well as a second plurality of keys from the plurality of key declaration strings; wherein the plurality of source code tokens includes the plurality of domain host names, the plurality of URI path strings, the first plurality of keys, and the second plurality of keys.