A system, method and computer program product are provided for policy-based billing for a network session. Initially, a plurality of packets is received by a plurality of analyzers. Thereafter, the packets are aggregated. Next, the plurality of packets is analyzed to identify a plurality of flows and an session associated with the flows. At least one application associated with the session is also identified. The session is then reconstructed utilizing the identified application. A user associated with the session is then identified along with a policy. The user is then billed for the session in accordance with the policy.