# US 2018/0027416 A1 · Providing security through characterizing mobile traffic by domain names > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0027416 A1 - Document ID: US20180027416A1 - Status: Published application - Kind: A1 - Application number: 15/217,279 - Filed: 2016-07-22 - Published: 2018-01-25 - Earliest claimed: 2016-07-22 - Assignees: AT&T Intellectual Property I, L.P. - Applicants: AT&T Intellectual Property I, L.P. - Inventors: JEFFREY BICKFORD; Wei Wang - Web page: https://patentgrep.com/patent/US20180027416A1 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04W 4/12: Messaging; Mailboxes; Announcements - H04W 12/128: Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware - H04L 47/2441: relying on flow classification, e.g. using integrated services [IntServ] - H04L 61/4511: using domain name system [DNS] - H04L 63/1458: {Denial of Service} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A method, computer-readable medium, and apparatus for classifying mobile traffic for securing a network or a mobile user endpoint device are disclosed. For example, a method may include a processor for classifying mobile network traffic using a probabilistic model for a plurality of mobile software applications based on a distribution of domain names, detecting an anomaly associated with a mobile software application of the plurality of mobile software applications, and performing a remedial action to address the anomaly. ## Claims ### Claim 1 A device comprising: a processor; and a computer-readable medium storing instructions which, when executed by the processor, cause the processor to perform operations, the operations comprising: classifying mobile network traffic using a probabilistic model for a plurality of mobile software applications based on a distribution of domain names; detecting an anomaly associated with a mobile software application of the plurality of mobile software applications; and performing a remedial action to address the anomaly. ### Claim 2 (depends on 1) The device of claim 1, wherein the remedial action comprises sending a notification to a mobile endpoint device having the mobile software application. ### Claim 3 (depends on 2) The device of claim 2, wherein the notification contains a request to a user of the mobile endpoint device having the mobile software application to deactivate or deinstall the mobile software application. ### Claim 4 (depends on 1) The device of claim 1, wherein the remedial action comprises sending a notification to a developer of the mobile software application. ### Claim 5 (depends on 1) The device of claim 1, wherein the remedial action comprises sending a notification to an entity responsible for a mobile endpoint device having the mobile software application. ### Claim 6 (depends on 5) The device of claim 5, wherein the entity comprises a business entity, a governmental agency, a guardian or a parent. ### Claim 7 (depends on 1) The device of claim 1, wherein the remedial action comprises allocating an additional network resource to address the anomaly. ### Claim 8 (depends on 1) The device of claim 1, wherein the remedial action comprises blocking mobile traffic from a mobile endpoint device having the mobile software application. ### Claim 9 (depends on 1) The device of claim 1, wherein the remedial action comprises blocking mobile traffic from a functional domain name correlated to the mobile software application, or throttling the mobile traffic from the functional domain name correlated to the mobile software application. ### Claim 10 (depends on 1) The device of claim 1, the operations further comprising: retraining the probabilistic model on a periodic basis. ### Claim 11 A method comprising: classifying, by a processor, mobile network traffic using a probabilistic model for a plurality of mobile software applications based on a distribution of domain names; detecting, by the processor, an anomaly associated with a mobile software application of the plurality of mobile software applications; and performing, by the processor, a remedial action to address the anomaly. ### Claim 12 (depends on 11) The method of claim 11, wherein the remedial action comprises sending a notification to a mobile endpoint device having the mobile software application. ### Claim 13 (depends on 12) The method of claim 12, wherein the notification contains a request to a user of the mobile endpoint device having the mobile software application to deactivate or deinstall the mobile software application. ### Claim 14 (depends on 11) The method of claim 11, wherein the remedial action comprises sending a notification to a developer of the mobile software application. ### Claim 15 (depends on 11) The method of claim 11, wherein the remedial action comprises sending a notification to an entity responsible for a mobile endpoint device having the mobile software application. ### Claim 16 (depends on 15) The method of claim 15, wherein the entity comprises a business entity, a governmental agency, a guardian or a parent. ### Claim 17 (depends on 11) The method of claim 11, wherein the remedial action comprises allocating an additional network resource to address the anomaly. ### Claim 18 (depends on 11) The method of claim 11, wherein the remedial action comprises blocking mobile traffic from a mobile endpoint device having the mobile software application. ### Claim 19 (depends on 11) The method of claim 11, wherein the remedial action comprises blocking mobile traffic from a functional domain name correlated to the mobile software application, or throttling the mobile traffic from the functional domain name correlated to the mobile software application. ### Claim 20 A tangible computer-readable medium storing instructions which, when executed by a processor, cause the processor to perform operations, the operations comprising: classifying mobile network traffic using a probabilistic model for a plurality of mobile software applications based on a distribution of domain names; detecting an anomaly associated with a mobile software application of the plurality of mobile software applications; and performing a remedial action to address the anomaly.