Deriving mobile application usage from network traffic

A non-transitory computer readable medium storing instructions that when executed by a processor, configures the processor to:

• determine an application list of different types of applications executing on a device;
• determine application strings associated with the applications, wherein the application strings include an application name string, a package name string, and a category string;
• receive network consumption data for a process executing on the device;
• determine consumption data strings from the network consumption data, wherein the consumption data strings include a host string and a user-agent string;
• determine match scores between the application strings and the consumption data strings by:
• generating a search matrix between the application strings and the consumption data strings, the search matrix comprising bi-directional search paths between the application strings and the consumption data strings and each of the bi-directional search paths having a weighting value;
• identifying, based on different types of rules, matches between the application strings and the consumption data strings along the weighted search paths of the search matrix;
• and
• applying a weighting value to each of the matches based on the weighting value associated with the weighted search path along which the match was identified;
• identify an application from the application list for the process in response to determining the match scores satisfy a match score threshold;
• associate the network consumption data for the process with the identified application;
• generate usage data for the identified application by aggregating network consumption data associated with the identified application over time;
• receive second network consumption data for a second process executing on the device;
• determine second consumption data strings from the second network consumption data;
• determine second match scores between the application strings and the second network consumption data strings;
• determine whether the second match scores satisfy the match score threshold;
• associate, in response to determining that the second match scores fail to satisfy the match score threshold, the second network consumption data for the second process with one of an Internet browser application, an application including advertising, a system service, or an email application;
• and
• generate a report indicating a list of applications executing on the device and the usage data or the network consumption data associated with the different types of applications.

A system, comprising:

• circuitry comprising a processor and a non-transitory memory, the circuitry is configured to;
• determine an application list of different types of applications executing on a device;
• determine application strings associated with the applications, wherein the application strings include an application name string, a package name string, and a category string;
• receive network consumption data for a process executing on the device;
• determine consumption data strings from the network consumption data, wherein the consumption data strings include a host string and a user-agent string;
• determine match scores between the application strings and the consumption data strings by:
• generating a search matrix between the application strings and the consumption data strings, the search matrix comprising bi-directional search paths between the application strings and the consumption data strings and each of the bi-directional search paths having a weighting value;
• identifying, based on different types of rules, matches between the application strings and the consumption data strings along the weighted search paths of the search matrix;
• and
• applying a weighting value to each of the matches based on the weighting value associated with the weighted search path along which the match was identified;
• identify an application from the application list for the process in response to determining the match scores satisfy a match score threshold;
• associate the network consumption data for the process with the identified application;
• generate usage data for the identified application by aggregating network consumption data associated with the identified application over time;
• receive second network consumption data for a second process executing on the device;
• determine second consumption data strings from the second network consumption data;
• determine second match scores between the application strings and the second network consumption data strings;
• determine whether the second match scores satisfy the match score threshold;
• associate, in response to determining that the second match scores fail to satisfy the match score threshold, the second network consumption data for the second process with one of an internet browser application, an application including advertising, a system service, or an email application;
• and
• generate a report indicating a list of applications executing on the device and the usage data or the network consumption data associated with the different types of applications.