Application identification and control in a network device

1. A computer-implemented method for application identification and control in a network device, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

establishing, at a network device, a Virtual Private Network (VPN) tunnel through which all Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) traffic sent from or received at the network device is routed;

monitoring, at the network device, all TCP and UDP traffic sent from or received at the network device through the VPN tunnel;

extracting, at the network device, payload data from the monitored TCP and UDP traffic;

analyzing the extracted payload data to identify applications executing on the network device that sent or received the monitored TCP and UDP traffic; and

taking, at the network device, a security action on the network device based on the identified applications.

2. The method of claim 1 , wherein the establishing, at the network device, of the VPN tunnel is performed by a security application executing on the network device using a standard VPN Application Programming Interface (API) of an operating system executing on the network device.

3. The method of claim 2 , wherein:

the operating system is a closed operating system; and

the standard VPN API is an NEPacketTunnelProvider VPN API.

4. The method of claim 2 , wherein the operating system is a closed operating system.

5. The method of claim 1 , wherein the analyzing of the extracted payload data is performed at the network device by a security application executing on the network device.

6. The method of claim 1 , wherein the monitoring and extracting is performed at the network device without awareness by the identified applications executing on the network device, without modification of the monitored TCP and UDP traffic, and without rerouting the monitored TCP and UDP traffic through another device.

7. A computer-implemented method for application identification and control in a network device, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

establishing, at a network device, a Virtual Private Network (VPN) tunnel through which all Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) traffic sent from or received at the network device is routed;

monitoring, at the network device, all TCP and UDP traffic sent from or received at the network device through the VPN tunnel;

extracting, at the network device, payload data from the monitored TCP and UDP traffic;

sending, from the network device, and receiving, at a network server, the extracted payload data;

analyzing, at the network server, the extracted payload data to identify applications executing on the network device that sent or received the monitored TCP and UDP traffic;

sending, from the network server, and receiving, at the network device, an indication of the identified applications; and

taking, at the network device, a security action on the network device based on the identified applications.

8. The method of claim 7 , wherein:

the establishing, monitoring, extracting, and taking are performed at the network device by a first security application executing on the network device; and

the analyzing is performed at the network server by a second security application executing on the network server.

9. The method of claim 8 , wherein the performing of the analyzing by the second security application executing on the network server reduces power consumption at the network device.

10. The method of claim 8 , wherein:

the network device is a cellular device; and

the network server is operated by a carrier of a cellular network utilized by the cellular device.

11. The method of claim 10 , wherein the performing of the analyzing by the second security application occurs whenever the cellular device is connected to the cellular network.

12. The method of claim 7 , wherein the taking, at the network device, of the security action comprises one or more of:

restricting TCP and UDP traffic sent from or received at one or more of the identified applications at the network device; and

enforcing a security policy on one or more of the identified applications at the network device.

13. The method of claim 7 , wherein:

the identifying of the applications executing on the network device further comprises classifying the applications as comprising one or more of: a spyware, a virus, a malware, a worm, a logic bomb, a trapdoor, a Trojan horse, a Remote Admin Trojan (RAT), a malware, a ransomware, a mobile malicious code, a malicious font, and a rootkit; and

the classifying is performed using fuzzy matching.

14. The method of claim 7 , wherein the monitoring and extracting is performed at the network device without awareness by the identified applications executing on the network device, without modification of the monitored TCP and UDP traffic, and without rerouting the monitored TCP and UDP traffic through another device.

15. One or more non-transitory computer-readable media comprising one or more computer-readable instructions that, when executed by one or more processors of one or more computing devices, cause the one or more computing devices to perform a method for application identification and control in a network device, the method comprising:

establishing, at a network device, a Virtual Private Network (VPN) tunnel through which all Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) traffic sent from or received at the network device is routed;

monitoring, at the network device, all TCP and UDP traffic sent from or received at the network device through the VPN tunnel;

extracting, at the network device, payload data from the monitored TCP and UDP traffic;

analyzing the extracted payload data to identify applications executing on the network device that sent or received the monitored TCP and UDP traffic; and

taking, at the network device, a security action on the network device based on the identified applications.

16. The one or more non-transitory computer-readable media of claim 15 , wherein:

an operating system executing on the network device is a closed operating system; and

the establishing, at the network device, of the VPN tunnel is performed by a security application executing on the network device using a standard VPN Application Programming Interface (API) of the closed operating system executing on the network device.

17. The one or more non-transitory computer-readable media of claim 15 , wherein the analyzing of the extracted payload data comprises:

sending, from the network device, and receiving, at a network server, the extracted payload data;

analyzing, at the network server, the extracted payload data to identify the applications executing on the network device that sent or received the monitored TCP and UDP traffic; and

sending, from the network server, and receiving, at the network device, an indication of the identified applications.

18. The one or more non-transitory computer-readable media of claim 17 , wherein:

the network device is a cellular device;

the network server is operated by a carrier of a cellular network utilized by the cellular device; and

the performing of the analyzing occurs whenever the cellular device is connected to the cellular network.

19. The one or more non-transitory computer-readable media of claim 15 , wherein the taking, at the network device, of the security action comprises one or more of:

restricting TCP and UDP traffic sent from or received at one or more of the identified applications at the network device; and

enforcing a security policy on one or more of the identified applications at the network device.

20. The one or more non-transitory computer-readable media of claim 15 , wherein the monitoring and extracting is performed at the network device without awareness by the identified applications executing on the network device, without modification of the monitored TCP and UDP traffic, and without rerouting the monitored TCP and UDP traffic through another device.