For the “Unclassified” Traffic, how should we identify what applications these represents?

Sinefa identifies applications through powerful L7 definition and if there's anything using particular ports that haven't been classified through our L7 definition, they get grouped as Unclassified.
In most cases, customers will always have some Unclassified (with ports listed) traffic, especially for internet traffic. Typically, there are half a dozen ports that maybe at the top of the list and these are the ones you will need to focus on. The rest is noise.

Other than the ports & protocols/IPs, customer can also do tcpdumps to get more info. Once you know what the port is - best thing to do would be to add that port that's falling under Unclassified in Settings > Applications, allow it to populate data and appear in the reporting list. Customer will then be able to drill down from there and see what machines are utilizing that port and see what apps are on those machines communicating on that port.