Application identification using network traffic

1. A method, comprising:

monitoring activity of one or more client devices to detect one or more sets of network traffic, wherein a set of network traffic of the one or more sets of network traffic comprises at least one of:

transmission of data by a first client device of the one or more client devices to one or more first hosts; or

reception of data by the first client device from one or more second hosts;

analyzing the one or more sets of network traffic to generate a set of network traffic information associated with a first application, wherein the set of network traffic information is indicative of a first set of hosts associated with the first application, wherein the analyzing the one or more sets of network traffic comprises clustering a plurality of hosts associated with the one or more sets of network traffic into one or more sets of hosts associated with one or more applications, wherein the clustering comprises responsive to determining that a first host is associated with multiple applications comprising the first application and a second application, not including the first host in the first set of hosts;

detecting first network traffic associated with a second client device; and

determining that the first network traffic is associated with the first application based upon the first network traffic and the set of network traffic information associated with the first application.

2. The method of claim 1 , wherein:

a set of hosts of the one or more sets of hosts is associated with an application of the one or more applications;

the one or more sets of hosts comprise the first set of hosts; and

the one or more applications comprise the first application.

3. The method of claim 2 , wherein the clustering the plurality of hosts associated with the one or more sets of network traffic into the one or more sets of hosts is performed based upon:

one or more temporal sequences of host events of the one or more sets of network traffic, wherein a host event of the host events corresponds to at least one of data transmission to a second host by a third client device or data reception from a third host by a fourth client device.

4. The method of claim 3 , comprising:

determining a set of quantities of host events associated with the first set of hosts, wherein:

a quantity of host events of the set of quantities of host events corresponds to host events, that occur in association with the first application, associated with a host of the first set of hosts; and

the set of network traffic information is indicative of the set of quantities of host events.

5. The method of claim 2 , wherein the clustering the plurality of hosts associated with the one or more sets of network traffic into the one or more sets of hosts is performed based upon:

host names associated with the plurality of hosts.

6. The method of claim 1 , wherein the determining that the first host is associated with the first application and the second application is performed based upon a comparison of a first quantity of client devices of a first plurality of client devices associated with at least one of data reception from the first host or data transmission to the first host during a first period of time and a second quantity of client devices of a second plurality of client devices associated with accessing the first application during the first period of time.

7. The method of claim 1 , wherein the determining that the first network traffic is associated with the first application is performed based upon a determination that a host associated with the first network traffic is comprised within the first set of hosts.

8. The method of claim 3 , wherein:

the set of network traffic information is indicative of one or more first temporal sequences associated with the first application and the first set of hosts; and

the determining that the first network traffic is associated with the first application is performed based upon a determination that a sequence of host events associated with the first network traffic matches a temporal sequence of the one or more first temporal sequences.

9. The method of claim 1 , comprising:

generating a similarity score based upon the first network traffic and the set of network traffic information associated with the first application, wherein the determining that the first network traffic is associated with the first application is performed based upon a determination that the similarity score meets a similarity score threshold.

10. The method of claim 9 , wherein the similarity score is indicative of a probability that the first network traffic is associated with the first application.

11. The method of claim 1 , comprising:

selecting a transmission content item for transmission to the second client device based upon the first application.

12. The method of claim 11 , comprising:

responsive to receiving a request for content associated with the second client device, transmitting the transmission content item to the second client device.

13. A computing device comprising:

a processor; and

memory comprising processor-executable instructions that when executed by the processor cause performance of operations, the operations comprising:

monitoring activity of one or more client devices to detect one or more sets of network traffic, wherein a set of network traffic of the one or more sets of network traffic comprises at least one of:

transmission of data by a first client device of the one or more client devices to one or more first hosts; or

reception of data by the first client device from one or more second hosts;

analyzing the one or more sets of network traffic to generate a set of network traffic information associated with a first application, wherein the set of network traffic information is indicative of a first set of hosts associated with the first application, wherein the analyzing the one or more sets of network traffic comprises clustering a plurality of hosts associated with the one or more sets of network traffic into one or more sets of hosts associated with one or more applications, wherein the clustering is based upon a comparison of a first quantity of client devices of a first plurality of client devices associated with at least one of data reception from a first host or data transmission to the first host during a first period of time and a second quantity of client devices of a second plurality of client devices associated with accessing the first application during the first period of time;

detecting first network traffic associated with a second client device; and

determining that the first network traffic is associated with the first application based upon the first network traffic and the set of network traffic information associated with the first application.

14. The computing device of claim 13 , wherein:

a set of hosts of the one or more sets of hosts is associated with an application of the one or more applications;

the one or more sets of hosts comprise the first set of hosts; and

the one or more applications comprise the first application.

15. The computing device of claim 14 , wherein the clustering the plurality of hosts associated with the one or more sets of network traffic into the one or more sets of hosts is performed based upon at least one of:

one or more temporal sequences of first host events of the one or more sets of network traffic, wherein a host event of the first host events corresponds to at least one of data transmission to a second host by a third client device or data reception from a third host by a fourth client device; or

host names associated with the plurality of hosts.

16. The computing device of claim 15 , the operations comprising:

determining a set of quantities of host events associated with the first set of hosts, wherein:

a quantity of host events of the set of quantities of host events corresponds to host events, that occur in association with the first application, associated with a host of the first set of hosts; and

the set of network traffic information is indicative of the set of quantities of host events.

17. A non-transitory machine readable medium having stored thereon processor-executable instructions that when executed cause performance of operations, the operations comprising:

monitoring activity of one or more client devices to detect one or more sets of network traffic, wherein a set of network traffic of the one or more sets of network traffic comprises at least one of:

transmission of data by a first client device of the one or more client devices to one or more first hosts; or

reception of data by the first client device from one or more second hosts;

analyzing the one or more sets of network traffic to generate a set of network traffic information associated with a first application, wherein the set of network traffic information is indicative of a first set of hosts associated with the first application,

wherein the analyzing the one or more sets of network traffic comprises:

clustering a plurality of hosts associated with the one or more sets of network traffic into one or more sets of hosts associated with one or more applications, wherein:

a set of hosts of the one or more sets of hosts is associated with an application of the one or more applications;

the one or more sets of hosts comprise the first set of hosts; and

the one or more applications comprise the first application;

the clustering comprises responsive to determining that a first host is associated with the first application and a second application, not including the first host in the one or more sets of hosts; and

the determining that the first host is associated with the first application and the second application is performed based upon a comparison of a first quantity of client devices of a first plurality of client devices associated with at least one of data reception from the first host or data transmission to the first host during a first period of time and a second quantity of client devices of a second plurality of client devices associated with accessing the first application during the first period of time;

detecting first network traffic associated with a second client device; and

determining that the first network traffic is associated with the first application based upon the first network traffic and the set of network traffic information associated with the first application.

18. The non-transitory machine readable medium of claim 17 , wherein the clustering the plurality of hosts associated with the one or more sets of network traffic into the one or more sets of hosts is performed based upon:

host names associated with the plurality of hosts.

19. The non-transitory machine readable medium of claim 17 , wherein the clustering the plurality of hosts associated with the one or more sets of network traffic into the one or more sets of hosts is performed based upon:

one or more temporal sequences of first host events of the one or more sets of network traffic, wherein a host event of the first host events corresponds to at least one of data transmission to a second host by a third client device or data reception from a third host by a fourth client device.

20. The non-transitory machine readable medium of claim 19 , the operations comprising:

determining a set of quantities of host events associated with the first set of hosts, wherein:

a quantity of host events of the set of quantities of host events corresponds to host events, that occur in association with the first application, associated with a host of the first set of hosts; and

the set of network traffic information is indicative of the set of quantities of host events.