Deriving mobile application usage from network traffic

1. A method, performed by an Application Monitoring (AM) System that is connected via a network to one or more devices, comprising:

determining an application list of different types of applications executing on a device of the one or more devices;

determining application strings associated with the applications, wherein the application strings include an application name string, a package name string, and a category string;

receiving network consumption data for a process executing on the device of the one or more devices;

determining consumption data strings from the network consumption data, wherein the consumption data strings include a host string and a user-agent string;

determining match scores between the application strings and the consumption data strings by:

generating a search matrix between the application strings and the consumption data strings, the search matrix comprising bi-directional search paths between the application strings and the consumption data strings and each of the bi-directional search paths having a weighting value;

identifying, based on different types of rules, matches between the application strings and the consumption data strings along the weighted search paths of the search matrix; and

applying a weighting value to each of the matches based on the weighting value associated with the weighted search path along which the match was identified;

identifying an application from the application list for the process in response to determining the match scores satisfy a match score threshold;

associating the network consumption data for the process with the identified application;

generating usage data for the identified application by aggregating network consumption data associated with the identified application over time;

generating second match scores associated with second network consumption data for a second process executing on the device of the one or more devices;

in response to determining the second match scores fail to satisfy the match score threshold, associating the second network consumption data for the second process with one of an internet browser application, an application including advertising, a system service, or an email application; and

generating a report indicating a list of applications executing on the device of the one or more devices and the usage data or the network consumption data associated with the different types of applications.

2. The method of claim 1 , wherein the bi-directional search paths include search paths between the application name string and the user-agent string, between the application name string and the host string, between the package name string and the user-agent string, and between the package name string and the host string.

3. The method of claim 1 , wherein identifying an application from the application list for the process includes:

generating a network traffic signature for an Internet entity from historical

network consumption data associated with the Internet entity;

comparing the network consumption data of the process with the network

traffic signature to match the network consumption data with the

network traffic signature; and

assigning the network consumption data matched with the network traffic

signature to the application.

4. The method of claim 1 , wherein the network consumption data for the process includes a usage time parameter and wherein:

associating the network consumption data tor the process with the

identified application includes associating a value of the usage time

parameter with the identified application; and

generating the usage data includes aggregating values of the usage time

parameter.

5. The method of claim 1 , further comprising, subsequent to associating the network consumption data for the process with the identified application, updating a usage time parameter of the network consumption data by incorporating a second usage time from the second network consumption data associated with the second process based on a ranking of the process and the second process.

6. The method of claim 1 , further comprising updating the usage data of the identified application based on:

determining an application type of the identified application; or

determining a network consumption data pattern identified from the usage

data of the identified application.

7. The method of claim 1 , wherein the different types of rules include a longest common substring match for a host string to package name string match.

8. The method of claim 1 , wherein the different types of rules include a string match that identifies a product name portion of the user-agent string inside the application name string for a user-agent string to application name string match.

9. The method of claim 1 , wherein the matching strings are defined by a white list and a black list of strings associated with the weighting value of each of the matches.

10. A non-transitory computer readable medium storing instructions that when executed by a processor, configures the processor to:

determine an application list of different types of applications executing on a device;

determine application strings associated with the applications, wherein the application strings include an application name string, a package name string, and a category string;

receive network consumption data for a process executing on the device;

determine consumption data strings from the network consumption data, wherein the consumption data strings include a host string and a user-agent string;

determine match scores between the application strings and the consumption data strings by:

generating a search matrix between the application strings and the consumption data strings, the search matrix comprising bi- directional search paths between the application strings and the consumption data strings and each of the bi-directional search paths having a weighting value;

identifying, based on different types of rules, matches between the application strings and the consumption data strings along the weighted search paths of the search matrix; and

applying a weighting value to each of the matches based on the weighting value associated with the weighted search path along which the match was identified;

identify an application from the application list for the process in response to determining the match scores satisfy a match score threshold;

associate the network consumption data for the process with the identified application;

generate usage data for the identified application by aggregating network consumption data associated with the identified application over time;

generate second match scores associated with second network consumption data for a second process executing on the device;

in response to determining the second match scores fail to satisfy the match score threshold, associate the second network consumption data for the second process with one of an internet browser application, an application including advertising, a system service, or an email application; and

generate a report indicating a list of applications executing on the device and the usage data or the network consumption data associated with the different types of applications.

11. The non-transitory computer readable medium of claim 10 , wherein the bi-directional search paths include search paths between the application name string and the user-agent string, between the application name string and the host string, between the package name string and the user-agent string, and between the package name string and the host string.

12. The non-transitory computer readable medium of claim 10 , wherein the instructions that configure the processor to identify an application from the application list for the process include the instructions configuring the processor to:

generate a network traffic signature for an Internet entity from historical

network consumption data associated with the Internet entity;

compare the network consumption data of the process with the network

traffic signature to match the network consumption data with the

network traffic signature; and

assign the network consumption data matched with the network traffic

signature to the identified application.

13. The non-transitory computer readable medium of claim 10 , wherein the network consumption data for the process includes a usage time parameter and wherein:

associating the network consumption data for the process with the

identified application includes the processor being configured to

associate a value of the usage time parameter with the identified

application; and

generating the usage data includes the processor being configured to

aggregate values of the usage time parameter.

14. The non-transitory computer readable medium of claim 10 , wherein the instructions further configure the processor to, subsequent to associating the network consumption data for the process with the identified application, update a usage time parameter of the network consumption data by incorporating a second usage time from the second network consumption data associated with the second process based on a ranking of the process and the second process.

15. The non-transitory computer readable medium of claim 10 , wherein the instructions further configure the processor to update the usage data of the identified application based on:

determining an application type of the identified application; or

determining a network consumption data pattern identified from the usage

data of the identified application.

16. The non-transitory computer readable medium of claim 10 , wherein the different types of rules include a longest common substring match for a host string to package name string match.

17. The non-transitory computer readable medium of claim 10 , wherein the different types of rules include a string match that identifies a product name portion of the user-agent string inside the application name string for a user-agent string to application name string match.

18. The non-transitory computer readable medium of claim 10 , wherein the matching strings are defined by a white list and a black list of strings associated with the weighting value of each of the matches.

19. A system, comprising: circuitry comprising a processor and a non-transitory memory, the circuitry is configured to:

determine an application list of different types of applications executing on a device;

determine application strings associated with the applications, wherein the application strings include an application name string, a package name string, and a category string;

receive network consumption data for a process executing on the device;

determine consumption data strings from the network consumption data, wherein the consumption data strings include a host string and a user-agent string;

determine match scores between the application strings and the consumption data strings by:

generating a search matrix between the application strings and the consumption data strings, the search matrix comprising bi-directional search paths between the application strings and the consumption data strings and each of the bi- directional search paths having a weighting value;

identifying, based on different types of rules, matches between the application strings and the consumption data strings along the weighted search paths of the search matrix; and

applying a weighting value to each of the matches based on the weighting value associated with the weighted search path along which the match was identified;

identify an application from the application list for the process in response to determining the match scores satisfy a match score threshold;

associate the network consumption data for the process with the identified application;

generate usage data for the identified application by aggregating network consumption data associated with the identified application over time;

generate second match scores associated with second network consumption data for a second process executing on the device;

in response to determining the second match scores fail to satisfy the match score threshold, associate the second network consumption data for the second process with one of an internet browser application, an application including advertising, a system service, or an email application; and

generate a report indicating a list of applications executing on the device and the usage data or the network consumption data associated with the different types of applications.