Application behavior detection using network traffic
Systems and methods for detecting application behavior using network traffic are described herein. The systems and methods enable a network to utilize network traffic data to determine various metrics and behavioral patterns associated with applications and their use. The patterns can be used to monitor traffic from a specific user device and across the network. Further, the information may be used to generate a trust score that provides a network and/or a user with information relating to an application.
1. A method for detecting a use of an application on a network, the method comprising:
collecting a plurality of event data of a mobile device comprising a plurality of data record types;
sorting each of the plurality of event data according to the plurality of data record types;
determining that a first event data of the plurality of event data, associated with a first application, comprises unencrypted traffic;
based at least in part on the first event data comprising unencrypted data:
identifying a first uniform resource locator from the first event data,
extracting an identification from the first event data,
extracting key values from a bundle identification, and
performing a frequency analysis to allow filtering of the bundle identification from the event data;
determining that a second event data of the plurality of event data, associated with a second application, comprises encrypted traffic; and
based at least in part on the second event data comprising encrypted data:
identifying a server name indication (SNI);
extracting domain information from the second event data using the SNI; and
monitoring a behavior of the second event data to create a period behavior analysis.
2. The method of claim 1 , wherein the identification is the bundle identification.
3. The method of claim 1 , wherein the period behavior analysis comprises SNI requests of the first application associated with a time period.
4. The method of claim 1 , further comprising collecting and comparing the period behavior analysis of the first application on the mobile device to a plurality of second period behavior analyses for the first application on a plurality of second mobile devices.
5. The method of claim 1 , further comprising using the period behavior analysis or the frequency analysis to build a time series data set indicating a number of requests by the first application or the second application across the network.
6. The method of claim 5 , further comprising applying a low frequency filter to calculate at least one metric that characterizes a domain to remove noise from the period behavior analysis or the frequency analysis.
7. The method of claim 1 , further comprising calculating a sample entropy analysis of the second application.
8. The method of claim 7 , further comprising assigning a trust score to the second application based on the sample entropy analysis.
9. The method of claim 1 , further comprising assigning a trust score to the second application by calculating a Shannon entropy, wherein if the trust score is below a threshold, traffic associated with the second application is throttled to reduce a bandwidth usage of the second application.
10. A non-transitory computer-readable storage medium having computer-executable instructions stored thereupon that, when executed by a computer, cause the computer to perform acts comprising:
collecting a plurality of event data of a mobile device comprising a plurality of data record types;
sorting each of the plurality of event data according to the plurality of data record types;
determining that a first event data of the plurality of event data, associated with a first application, comprises unencrypted traffic;
based at least in part on the first event data comprising unencrypted data:
identifying a first uniform resource locator from the first event data,
extracting an identification from the first event data,
extracting key values from a bundle identification, and
performing a frequency analysis to allow filtering of the bundle identification from the event data;
determining that a second event data of the plurality of event data, associated with a second application, comprises encrypted traffic; and
based at least in part on the second event data comprising encrypted data:
identifying a server name indication (SNI);
extracting domain information from the second event data using the SNI; and
monitoring a behavior of the second event data to create a period behavior analysis.
11. The non-transitory computer-readable storage medium of claim 10 , the computer-executable instructions further the computer to perform causing acts comprising:
collecting and comparing the period behavior analysis of the first application on the mobile device to a plurality of second period behavior analyses for the first application on a plurality of second mobile devices.
12. The non-transitory computer-readable storage medium of claim 10 , the computer-executable instructions causing the computer to perform further acts comprising:
calculating a sample entropy analysis of the second application.
13. The non-transitory computer-readable storage medium of claim 12 , the computer-executable instructions causing the computer to perform further acts comprising:
assigning a trust score to the second application based on the sample entropy analysis, wherein if the trust score of the second application is below a threshold, traffic associated with the second application may be blocked.
14. The non-transitory computer-readable storage medium of claim 10 , the computer-executable instructions causing the computer to perform further acts comprising:
assigning a trust score to the second application by calculating a Shannon entropy.
15. The non-transitory computer-readable storage medium of claim 10 , the computer-executable instructions further the computer to perform causing acts comprising:
assigning a trust score to the second application by identifying an abnormal behavior from the period behavior analysis.
16. The non-transitory computer-readable storage medium of claim 15 , the computer-executable instructions further the computer to perform causing acts comprising:
filtering network traffic associated with the second application based on the trust score.
17. The non-transitory computer-readable storage medium of claim 16 , the computer-executable instructions further the computer to perform causing acts comprising:
providing a user of the second application with an indication that the second application has been filtered based on the trust score.
18. The non-transitory computer-readable storage medium of claim 15 , the computer-executable instructions further the computer to perform causing acts comprising:
providing a user of the second application with an indication of the trust score.
19. A system comprising:
a memory storing computer-executable instructions; and
a processor in communication with the memory, the computer-executable instructions causing the processor to perform acts comprising:
collecting a plurality of event data of a mobile device comprising a plurality of data record types;
sorting each of the plurality of event data according to the plurality of data record types;
determining that a first event data of the plurality of event data, associated with a first application, comprises unencrypted traffic;
based at least in part on determining that the first event data of the plurality of event data, associated with a first application, comprises unencrypted traffic:
identifying a first uniform resource locator from the first event data,
extracting an identification from the first event data,
extracting key values from a bundle identification, and
performing a frequency analysis to allow filtering of the bundle identification from the event data;
determining that a second event data of the plurality of event data, associated with a second application, comprises encrypted traffic; and
based at least in part on determining that the second event data of the plurality of event data, associated with a second application, comprises encrypted traffic:
identifying a server name indication (SNI);
extracting domain information from the second event data using the SNI; and
monitoring a behavior of the second event data to create a period behavior analysis.
20. The system of claim 19 , further comprising computer-executable instructions for:
collecting and comparing the period behavior analysis of the first application on the mobile device to a plurality of second period behavior analyses for the first application on a plurality of second mobile devices; and
applying a low frequency filter to calculate at least one metric that characterizes a domain to remove noise from the period behavior analysis or the frequency analysis.