Techniques to detect video transfer from network usage

An apparatus, comprising:

• a processor circuit on a device;
• a network usage monitoring component operative on the processor circuit to determine a foreground application on a device;
• monitor network usage for the foreground application on the device;
• and determine whether the network usage for the foreground application exceeds a video usage signature threshold;
• and
• a logging component operative to log a first state in a video usage time series log at a first time when the network usage for the foreground application exceeds the video usage signature threshold, and logging a second state in the video usage time series log at a second time when the network usage for the foreground application is below the video usage signature threshold, the first state indicative of video transfer activity and the second state indicative of no video transfer activity.

At least one non-transitory computer-readable storage medium comprising instructions that, when executed, cause a system to:

• determine a foreground application on a device;
• monitor network usage for the foreground application on the device;
• determine whether the network usage for the foreground application exceeds a video usage signature threshold;
• and
• log a first state in a video usage time series log at a first time when the network usage for the foreground application exceeds the video usage signature threshold, and logging a second state in the video usage time series log at a second time when the network usage for the foreground application is below the video usage signature threshold, the first state indicative of video transfer activity and the second state indicative of no video transfer activity.