The signature we use to determine application (and transaction) detection differs per app. Rather than just simple port and protocol matching, our detection library uses some advanced application recognition techniques.
For example:
- Pattern Matching
- Conversation Semantics
- Heuristic analysis
- Flow Association
Ultimately though, our development team assures me that it is mostly magic.