Mobile application identification in network traffic via a search engine approach

A system for identifying a network application, comprising:

• a processor of a computer system;
• memory comprising instructions executable by the processor, the instructions when executed by the processor comprising functionality for:
• obtaining, from a network application distribution platform, an executable binary data package of the network application, wherein the executable binary data package comprises an executable binary file and metadata associated with the executable binary file;
• extracting a network application download package name of the executable binary data package from the metadata to obtain first application tokens comprising the network application download package name of the executable binary data package;
• obtaining, from the network application distribution platform, a link to an application content webpage;
• extracting, in response to obtaining the link, a network application identifier from metadata of the application content webpage to obtain second application tokens based on the network application identifier;
• generating an index document of the network application based on a plurality of source code tokens, the first application tokens, and the second application tokens, wherein the index document is included in a plurality of index documents corresponding to a plurality of network applications;
• extracting a plurality of packet header tokens from a packet header of a packet in a flow to generate one or more query documents;
• comparing, using a commercial search engine, the plurality of packet header tokens of the one or more query documents to the plurality of index documents to generate a plurality of match scores;
• and
• determining, based at least on a match score of the plurality of match scores, that the flow is generated by the network application.

A non-transitory computer readable medium embodying instructions for identifying a network application, the instructions when executed by a processor comprising functionality for:

• obtaining, from a network application distribution platform, an executable binary data package of the network application, wherein the executable binary data package comprises an executable binary file and metadata associated with the executable binary file;
• extracting a network application download package name of the executable binary data package from the metadata to obtain first application tokens comprising the network application download package name of the executable binary data package;
• obtaining, from the network application distribution platform, a link to an application content webpage;
• extracting, in response to obtaining the link, a network application identifier from metadata of the application content webpage to obtain second application tokens based on the network application identifier;
• generating an index document of the network application based on a plurality of source code tokens, the first application tokens, and the second application tokens, wherein the index document is included in a plurality of index documents corresponding to a plurality of network applications;
• extracting a plurality of packet header tokens from a packet header of a packet in a flow to generate one or more query documents;
• comparing, using a commercial search engine, the plurality of packet header tokens of the one or more query documents to the plurality of index documents to generate a plurality of match scores;
• and
• determining, based at least on a match score of the plurality of match scores, that the flow is generated by the network application.