Abstract: An application detection method includes receiving, from one or more user devices on a plurality of local networks, first network traffic metadata being related to a client application running on the one or more user devices, receiving, from a plurality of network traffic hubs of the plurality of local networks, second network traffic metadata corresponding to the first network traffic metadata but excluding user device specific data, generating a plurality of combined network traffic metadata datasets for each received first network traffic metadata and the corresponding second network traffic metadata by matching metadata attributes of the first and second network traffic metadata, generating an application detection model by using the plurality of combined network traffic metadata datasets, and using the application detection model for detecting further client applications running on one or more user devices on one or more local networks.