Application detection

An apparatus in a computer network system comprising:

• one or more processors;
• and
• a non-transitory computer-readable medium comprising stored program code, the program code comprising computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to:
• receive, from one or more user devices on a plurality of local networks, first network traffic metadata collected by the one or more user devices and being related to one or more client applications running on the one or more user devices, the first network traffic metadata comprising an application name of the one or more client applications, a target Internet Protocol (IP) address requested by the one or more client applications, and a timestamp of a connection request initiated by the one or more client applications;
• receive, from a plurality of network traffic hubs of the plurality of local networks, second network traffic metadata corresponding to the first network traffic metadata but excluding user device specific data related to the one or more user devices that is not visible on a network level for the plurality of network traffic hubs, the user device specific data related to the one or more user devices that is not visible on the network level for the plurality of network traffic hubs comprising one or more of a client application identity, an application name of the one or more client applications running on the one or more user devices, an identification name and a software version of the client application;
• generate a plurality of combined network traffic metadata datasets for each received first network traffic metadata and the corresponding second network traffic metadata by matching metadata attributes of the first network traffic metadata and the second network traffic metadata;
• generate an application detection model by using the plurality of combined network traffic metadata datasets;
• and
• use the application detection model for detecting further client applications running on one or more user devices on one or more local networks.

A non-transitory computer-readable medium comprising stored program code, the program code comprising computer-executable instructions that, when executed by a processor, cause the processor to:

• receive, from one or more user devices on a plurality of local networks, first network traffic metadata collected by the one or more user devices and being related to one or more client applications running on the one or more user devices, the first network traffic metadata comprising an application name of the one or more client applications, a target Internet Protocol (IP) address requested by the one or more client applications, and a timestamp of a connection request initiated by the one or more client applications;
• receive, from a plurality of network traffic hubs of the plurality of local networks, second network traffic metadata corresponding to the first network traffic metadata but excluding user device specific data related to the one or more user devices that is not visible on a network level for the plurality of network traffic hubs, the user device specific data related to the one or more user devices that is not visible on the network level for the plurality of network traffic hubs comprising one or more of a client application identity, an application name of the one or more client applications running on the one or more user devices, an identification name and a software version of the client application;
• generate a plurality of combined network traffic metadata datasets for each received first network traffic metadata and the corresponding second network traffic metadata by matching metadata attributes of the first network traffic metadata and the second network traffic metadata;
• generate an application detection model by using the plurality of combined network traffic metadata datasets;
• and
• use the application detection model for detecting further client applications running on one or more user devices on one or more local networks.