Techniques to identify application foreground / background state based on network traffic

1. A computer-implemented method, comprising:

receiving monitored network traffic from one or more network interface controllers, the monitored network traffic exchanged with a plurality of client devices over a monitored time period;

receiving a foreground activity profile, the foreground activity profile comprising one or more signals for distinguishing between foreground activity indicative of a foreground state of one or more profiled applications and background activity indicative of a background state of the one or more profiled applications, wherein the foreground activity profile is generated using machine learning based on training data generated from network traffic from a plurality of training client devices;

determining one or more active foreground applications in the monitored network traffic based on the foreground activity profile, wherein determining the one or more active foreground applications comprises determining that at least a portion of the monitored network traffic comprises background activity; and

logging that the one or more active foreground applications were active during the monitored time period.

2. The method of claim 1 , comprising:

generating active usage statistics for the one or more profiled applications based on the logging of the one or more active foreground applications.

3. The method of claim 1 , comprising:

generating background usage statistics for the one or more profiled applications for a subject client device of the plurality of client devices, the background usage statistics generated based on the logging of the one or more active foreground applications and the received monitored network traffic for the subject client device; and

transmitting the background usage statistics to the subject client device.

4. The method of claim 1 , the monitored network traffic received at one or more proxy servers for the plurality of client devices.

5. The method of claim 1 , the signals comprising one or more of: a maximum amount of data downloaded over a time window, a maximum amount of data uploaded over a time window, a maximum amount of data downloaded in a single request, a maximum amount of data uploaded in a single request, a maximum response time for a network server to respond to a single request, a maximum duration of an encrypted session, a maximum amount of data downloaded in a single encrypted session, a maximum amount of data uploaded in a single encrypted session, a maximum number of servers connected to over a time window, a maximum number of requests per minute over a time window, a maximum number of time slices in which there was network activity, a probability of a least-probable server accessed, a frequency of requests, time of day, contiguous app usage, contiguous web usage, and requests directed to analytics services.

6. The method of claim 1 , wherein the network traffic from a plurality of training client devices includes:

first training network traffic received from one or more network interface controllers, the first network traffic exchanged with a plurality of training client devices over a first time period; and

second training network traffic received from the one or more network interface controllers, the second network traffic exchanged with the plurality of training client devices over a second time period, the second time period associated with a higher predominance of background activity than the first time period.

7. The method of claim 6 , the first time period comprising one or more daytime periods and the second time period comprising one or more nighttime periods.

8. The method of claim 1 , the foreground activity profile comprising one or more non-application-specific signals for distinguishing between the foreground activity of the one or more profiled applications and the background activity of the one or more profiled applications.

9. The method of claim 1 , the foreground activity profile comprising one or more application-specific signals for distinguishing between the foreground activity of the one or more profiled applications and the background activity of the one or more profiled applications.

10. The method of claim 1 , wherein the network traffic from a plurality of training client devices includes:

first training network traffic received from one or more network interface controllers, the first network traffic exchanged with a plurality of updated training client devices; and

second training network traffic received from the one or more network interface controllers, the second network traffic exchanged with a plurality of non-updated training client devices, wherein the non-updated training client devices execute a version of an application that does not perform background activity.

11. An apparatus, comprising:

a processor circuit on a device;

a traffic monitoring component operative on the processor circuit to receive monitored network traffic from one or more network interface controllers at a proxy server for a plurality of client devices, the monitored network traffic exchanged with the plurality of client devices over a monitored time period; and

a traffic analysis component operative on the processor circuit to receive a foreground activity profile, the foreground activity profile comprising one or more signals for distinguishing between foreground activity indicative of a foreground state of one or more profiled applications and background activity indicative of a background state of the one or more profiled applications; determine one or more active foreground applications in the monitored network traffic based on the foreground activity profile, wherein determining the one or more active foreground applications comprises determining that at least a portion of the monitored network traffic comprises background activity; log that the one or more active foreground applications were active during the monitored time period; and generate active usage statistics for the one or more profiled applications based on the logging of the one or more active foreground applications;

wherein the foreground activity profile is generated using machine learning based on training data generated from network traffic from a plurality of training devices.

12. The apparatus of claim 11 , the signals comprising one or more of: a maximum amount of data downloaded over a time window, a maximum amount of data uploaded over a time window, a maximum amount of data downloaded in a single request, a maximum amount of data uploaded in a single request, a maximum response time for a network server to respond to a single request, a maximum duration of an encrypted session, a maximum amount of data downloaded in a single encrypted session, a maximum amount of data uploaded in a single encrypted session, a maximum number of servers connected to over a time window, a maximum number of requests per minute over a time window, a maximum number of time slices in which there was network activity, a probability of a least-probable server accessed, a frequency of requests, time of day, contiguous app usage, contiguous web usage, and requests directed to analytics services.

13. The apparatus of claim 11 , wherein the network traffic from a plurality of training client devices includes:

first training network traffic received from one or more network interface controllers, the first network traffic exchanged with a plurality of training client devices over a first time period; and

second training network traffic received from the one or more network interface controllers, the second network traffic exchanged with the plurality of training client devices over a second time period, the second time period associated with a higher predominance of background activity than the first time period.

14. The apparatus of claim 11 , wherein the first time and the second time period are dependent on the time of day.

15. The apparatus of claim 11 , wherein the network traffic from a plurality of training client devices includes:

first training network traffic received from one or more network interface controllers, the first network traffic exchanged with a plurality of updated training client devices; and

second training network traffic received from the one or more network interface controllers, the second network traffic exchanged with a plurality of non-updated training client devices, wherein the non-updated training client devices execute a version of an application that does not perform background activity.

16. At least one non-transitory computer-readable storage medium comprising instructions that, when executed, cause a system to:

receive monitored network traffic from one or more network interface controllers, the monitored network traffic exchanged with a plurality of client devices over a monitored time period;

receive a foreground activity profile, the foreground activity profile comprising one or more signals for distinguishing between foreground activity indicative of foreground state of one or more profiled applications and background activity indicative of a background state of the one or more profiled applications, wherein the foreground activity profile is generated using machine learning based on training data generated from network traffic from a plurality of training devices;

determine one or more active foreground applications in the monitored network traffic based on the foreground activity profile, wherein determining the one or more active foreground applications comprises determining that at least a portion of the monitored network traffic comprises background activity; and

generate active usage statistics for the one or more profiled applications based on the one or more active foreground applications being active during the monitored time period.

17. The non-transitory computer-readable storage medium of claim 16 , the signals comprising one or more of: a maximum amount of data downloaded over a time window, a maximum amount of data uploaded over a time window, a maximum amount of data downloaded in a single request, a maximum amount of data uploaded in a single request, a maximum response time for a network server to respond to a single request, a maximum duration of an encrypted session, a maximum amount of data downloaded in a single encrypted session, a maximum amount of data uploaded in a single encrypted session, a maximum number of servers connected to over a time window, a maximum number of requests per minute over a time window, a maximum number of time slices in which there was network activity, a probability of a least-probable server accessed, a frequency of requests, time of day, contiguous app usage, contiguous web usage, and requests directed to analytics services.

18. The non-transitory computer-readable storage medium of claim 16 , wherein the network traffic from a plurality of training client devices includes:

first training network traffic received from one or more network interface controllers, the first network traffic exchanged with a plurality of training client devices over a first time period; and

second training network traffic received from the one or more network interface controllers, the second network traffic exchanged with the plurality of training client devices over a second time period, the second time period associated with a higher predominance of background activity than the first time period.

19. The non-transitory computer-readable storage medium of claim 16 , the foreground activity profile comprising one or more non-application-specific signals for distinguishing between the foreground activity of the one or more profiled applications and the background activity of the one or more profiled applications.

20. The non-transitory computer-readable storage medium of claim 16 , the foreground activity profile comprising one or more application-specific signals for distinguishing between the foreground activity of the one or more profiled applications and the background activity of the one or more profiled applications.