I had a project I did for university a few years back, and we'd identify the browser or application just by looking at the timing information between packets (without looking at ports, source/destination, etc.).

We could identify malware with around 85% accuracy, which was pretty good without any other marker.