Mobile application identification in network traffic via a search engine approach

A system for identifying a network application, comprising:

• a processor of a computer system;
• memory comprising instructions executable by the processor, wherein the instructions comprises:
• a network application analyzer configured to:
• analyze a source code of a network application, among a plurality of network applications, to extract a plurality of source code tokens;
• generate an index document of the network application based on the plurality of source code tokens, wherein the index document is included in a plurality of index documents corresponding to the plurality of network applications, the plurality of index documents being loaded as a corpus into a search engine;
• a flow analyzer configured to:
• extract a plurality of packet header tokens from a packet header of a packet in a flow to generate one or more query documents;
• and
• a correlation analyzer configured to:
• compare, using the search engine, the plurality of packet header tokens of the one or more query documents to the plurality of index documents to generate a plurality of match scores, wherein each of the plurality of match scores represents a similarity measure between the plurality of packet header tokens and one of the plurality of index documents;
• and
• determine, based at least on a match score of the plurality of match scores and corresponding to the network application, that the flow is generated by the network application;
• and
• a repository configured to store the plurality of index documents.

A non-transitory computer readable medium embodying instructions for identifying a network application, the instructions when executed by a processor comprising functionally for:

• analyzing a source code of a network application, among a plurality of network applications, to extract a plurality of source code tokens;
• generating an index document of the network application based on the plurality of source code tokens, wherein the index document is included in a plurality of index documents corresponding to the plurality of network applications, the plurality of index documents being loaded as a corpus into a search engine;
• extracting a plurality of packet header tokens from a packet header of a packet in a flow to generate one or more query documents;
• comparing, using the search engine, the plurality of packet header tokens of the one or more query documents to the plurality of packet header tokens to the plurality of index documents to generate a plurality of match scores, wherein each of the plurality of match scores represents a similarity measure between the plurality of packet header tokens and one of the plurality of index documents;
• and
• determining, based at least on a match score of the plurality of match scores and corresponding to the network application, that the flow is generated by the network application.