Techniques to identify applications based on network traffic

• US 9,961,574 B1
• Filed: 03/09/2015
• Issued: 05/01/2018
• Est. Priority Date: 03/02/2015
• Status: Active Grant

• Current Assignee: Meta Platforms, Inc. (f/k/a Facebook, Inc.)
• Original Assignee: Meta Platforms, Inc. (f/k/a Facebook, Inc.)
• Inventors: Tubi, Lior, Priell, Nimrod, Nir, Israel, Naar, Dekel Shmuel
• Primary Examiner(s): Daya, Tejis
• Application Number:
  US14/641,860
• Time in Patent Office: 1,149 Days
• CPC Class Codes: H04L 43/065 related to network devices
• CPC Class Codes: H04L 43/067 using time frame reporting
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 43/18 Protocol analysers
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04M 1/72403 with means for local support of applications that increase the functionality
• CPC Class Codes: H04W 24/08 Testing, supervising or monitoring using real traffic

Abstract

Techniques to identify applications based on network traffic are described. In one embodiment, an apparatus may comprise a client record component, a traffic monitoring component, a profiling component, and a traffic analysis component. The client record component may be operative to store a client application map, the client application map to represent installations of a plurality of applications on a plurality of client devices. The traffic monitoring component may be operative to monitor training network traffic and additional network traffic on one or more network interfaces, the training network traffic generated by the plurality of client devices. The profiling component may be operative to generate a network profile map using machine learning based on the training network traffic and the client application map. The traffic analysis component may be operative to identify one or more application of the plurality of applications. Other embodiments are described and claimed.

Claims

1. A computer-implemented method, comprising:

receiving a client application map, the client application map to represent installations of a plurality of different applications on a plurality of client devices;

receiving training network traffic from one or more network interface controllers, the training network traffic exchanged with at least some of the plurality of client devices;

generating a network profile map using machine learning based on the training network traffic and the client application map, the network profile map comprising a first association between a first application of the different applications to a first application-specific traffic pattern of network traffic produced by the first application and a second association between a second application of the different applications to a second application-specific traffic pattern of network traffic produced by the second application; and

using the network profile map to identify one or more of an installation prevalence, market penetration, time-period based usage, or frequency of use of the plurality of different applications in non-training network traffic.

2. The method of claim 1, the application-specific traffic patterns based on at least one of uniform resource locators, hypertext transport protocol parameters, and user-agents associated with specific applications.

3. The method of claim 1, further comprising:

receiving additional network traffic; and

identifying one or more apps of the plurality of apps as having contributed to the additional network traffic based on the network profile map.

4. The method of claim 3, the additional network traffic associated with a particular client device, further comprising:

identifying one or more applications of the plurality of applications as being installed on the particular client device based on the one or more applications having been identified as contributing to the additional network traffic.

5. The method of claim 3, the additional network traffic associated with a second plurality of client devices, further comprising:

generating usage patterns for the second plurality of applications based on the one or more applications having been identified as contributing to the additional network traffic.

6. The method of claim 1, comprising:

identifying that a first set of client devices in the client application map that have a particular application installed and a second set of client devices in the client application map that do not have the particular application installed;

dividing the received training network traffic into a positive training set and a negative training set based on the client application map, wherein network traffic of the training network traffic is assigned to the positive training set when it is received from the first set of client devices, wherein network traffic of the training network traffic is assigned to the negative training set when it is received from the second set of client devices;

determining an application-specific traffic pattern for the particular application from the positive training set by detecting differences between the positive training set and the negative training set; and

adding the application-specific traffic pattern to the network profile map.

7. The method of claim 1, comprising:

receiving previous network traffic of the plurality of client devices;

detecting application downloads in the receiving previous network traffic; and

determining at least a portion of the client application map based on the detected application downloads.

8. The method of claim 1, comprising:

detecting that a particular application has had a release of an updated version;

detecting a change in the training network traffic after the release of the updated version of the particular app;

indicating that one or more client devices of the plurality of client devices have the particular application installed based on the change in the received network traffic being associated with the one or more client devices.

25. The method of claim 1, wherein the machine learning is configured to accommodate inexactness in sorting the training network traffic into positive and negative examples by identifying traffic patterns that are more prominent in the positive examples than in the negative examples.

9. An apparatus, comprising:

a processor circuit;

a client record component operative on the processor circuit to store a client application map, the client application map to represent installations of a plurality of different applications on a plurality of client devices;

a traffic monitoring component operative on the processor circuit to monitor training network traffic on one or more network interface controllers, the training network traffic generated by at least some of the plurality of client devices; and

a profiling component operative on the processor circuit to generate a network profile map using machine learning based on the training network traffic and the client application map, the network profile map comprising a first association between a first application of the different applications to a first application-specific traffic pattern of network traffic produced by the first application and a second association between a second application of the different applications to a second application-specific traffic pattern of network traffic produced by the second application, and operative to use the network profile map to identify one or more of an installation prevalence, market penetration, time-period based usage, or frequency of use of the plurality of different applications in non-training network traffic.

10. The apparatus of claim 9, the application-specific traffic patterns based on at least one of uniform resource locators, hypertext transport protocol parameters, and user-agents associated with specific applications.

11. The apparatus of claim 9, further comprising:

a traffic analysis component operative to identify one or more applications of the plurality of applications as having contributed to additional network traffic based on the network profile map.

12. The apparatus of claim 11, the additional network traffic associated with a particular client device, the traffic analysis component operative to identify one or more applications of the plurality of applications as being installed on the particular client device based on the one or more applications having been identified as contributing to the additional network traffic.

13. The apparatus of claim 11, the additional network traffic associated with a second plurality of client devices, the traffic analysis component operative to generate usage patterns for the second plurality of applications based on the one or more applications having been identified as contributing to the additional network traffic.

14. The apparatus of claim 9, the profiling component operative to:

identify that a first set of client devices in the client application map that have a particular application installed and a second set of client devices in the client application map that do not have the particular application installed;

divide the received training network traffic into a positive training set and a negative training set based on the client application map, wherein network traffic of the training network traffic is assigned to the positive training set when it is received from the first set of client devices, wherein network traffic of the training network traffic is assigned to the negative training set when it is received from the second set of client devices;

determine an application-specific traffic pattern for the particular application from the positive training set by detecting differences between the positive training set and the negative training set; and

add the application-specific traffic pattern to the network profile map.

15. The apparatus of claim 9, the traffic monitoring component operative to monitor previous network traffic of the plurality of client devices and detect application downloads in the monitored previous network traffic, wherein at least a portion of the client application map is determined based on the detected application downloads.

16. At least one non-transitory computer-readable storage medium comprising instructions that, when executed, cause a system to:

receive a client application map, the client application map to represent installations of a plurality of different applications on a plurality of client devices;

capture training network traffic for at least some of the plurality of client devices from one or more network interface controllers;

generate a network profile map using machine learning based on the training network traffic and the client application map, the network profile map comprising a first association between a first application of the different applications to a first application-specific traffic pattern of network traffic produced by the first application and a second association between a second application of the different applications to a second application-specific traffic pattern of network traffic produced by the second application; and

use the network profile map to identify one or more of an installation prevalence, market penetration, time-period based usage, or frequency of use of the plurality of different applications in non-training network traffic.

17. The computer-readable storage medium of claim 16, the application-specific traffic patterns based on at least one of uniform resource locators, hypertext transport protocol parameters, and user-agents associated with specific applications.

18. The computer-readable storage medium of claim 16, comprising further instructions that, when executed, cause a system to:

capture additional network traffic;

identify one or more applications of the plurality of applications as having contributed to the additional network traffic based on the network profile map; and

identify one or more applications of the plurality of applications as being active on one or more client devices based on the one or more applications being identified as contributing to the additional network traffic.

19. The computer-readable storage medium of claim 18, comprising further instructions that, when executed, cause a system to:

generate usage patterns for a second plurality of applications based on the one or more applications having been identified as contributing to the additional network traffic.

20. The computer-readable storage medium of claim 16, comprising further instructions that, when executed, cause a system to:

identify that a first set of client devices in the client application map that have a particular application installed and a second set of client devices in the client application map that do not have the particular application installed;

divide the received training network traffic into a positive training set and a negative training set based on the client application map, wherein network traffic of the training network traffic is assigned to the positive training set when it is received from the first set of client devices, wherein network traffic of the training network traffic is assigned to the negative training set when it is received from the second set of client devices;

determine an application-specific traffic pattern for the particular application from the positive training set by detecting differences between the positive training set and the negative training set; and

add the application-specific traffic pattern to the network profile map.

21. A computer-implemented method, comprising:

receiving a network profile map, the network profile map comprising a first association between a first application of a plurality of different applications to a first application-specific traffic pattern of network traffic produced by the first application and a second association between a second application of the different applications to a second application-specific traffic pattern of network traffic produced by the second application;

receiving additional network traffic;

identifying one or more applications of the plurality of different applications as having contributed to the additional network traffic based on the network profile map; and

using the network profile map to identify one or more of an installation prevalence, market penetration, time-period based usage, or frequency of use of the plurality of different applications in the additional network traffic.

22. The method of claim 21, the additional network traffic associated with a particular client device, further comprising:

identifying one or more applications of the plurality of applications as being installed on the particular client device based on the one or more applications having been identified as contributing to the additional network traffic.

23. The method of claim 21, the additional network traffic associated with a second plurality of client devices, further comprising:

generating usage patterns for the second plurality of applications based on the one or more applications having been identified as contributing to the additional network traffic.

24. The method of claim 21, the additional network traffic associated with a particular client device, the network profile map comprising an application-group traffic pattern, the application-group traffic pattern defining a relationship between a group of applications and network traffic indicative of the group of applications, further comprising:

detecting the application-group traffic pattern in the additional network traffic;

transmitting a listing of the group of applications to the particular client device; and

receiving an indication from the particular client device indicating that a particular application of the group of applications is confirmed as being installed on the particular client device.