The present invention has its application within the telecommunication sector, more specifically, relates to the analysis of mobile user traffic.
More particularly, the present invention refers to a method for detecting from mobile traffic applications (apps) of mobile user terminals (smartphones, tablets, etc.).
Smartphones offer users the possibility to install on them whatever applications (apps) they decide to (apart from preinstalled apps). These apps belong to categories as entertainment, sports, productivity, travel . . . . Therefore, applications installed in a certain smartphone provide useful information about its user profile, to be understood as the set of habits and preferences of a person.
Those apps require Internet connection for tasks as content update or access authorization. The set of queries or requests sent to retrieve data from Internet is here defined as traffic. Being a protocol a set of predefined rules that defines the way of transferring information, requests information may vary depending on the used protocol. Examples of information appearing in requests are: source IP, request date and time, domain or user agent. The latter concepts, domain and user agent, are defined as follows:                Domain is the unique name that identifies a website on the Internet.        User agent includes information about several aspects like: application source, device operating system or software version. It has to be emphasized that not every protocol includes the user agent field.        
The smartphones have recently experimented an exponential growth in terms of number of users and hours spent with them. In this context, knowing applications used by a customer will allow to precisely define its profile. A correct user profile is the key to success in multiple use-cases like recommender systems, protection against possible security threats (malicious apps) or statistical analysis, as defined as follows:                Recommender systems: Those systems are present in several areas such as cinema, music or shopping. They aim to predict user interests, i.e. user profile, on those areas using information of his activity. Based on these predictions, they provide recommendations to users about elements that match their interests. As more precise the predictions, the better the recommendations.        Malicious apps: Applications classified as malicious are, for example, those tricking users into unwanted pays or subscriptions.        Statistical analysis: Analysis over user profiles and their distribution, which can guide, for example, further commercial or investment decisions.        
Mobile Network Operators (MNOs) can obtain information required to define users profile from mobile traffic. A request is generated each time a mobile user interacts with an app on its smartphone. The request passes through the MNO infrastructure, which both stores it in a database as sends it to the Internet. Data stored in the MNO database is simplified information of HTTP and DNS requests. Hypertext Transfer Protocol (HTTP) is a protocol for transferring hypermedia files. Domain Name System (DNS) is a naming system for clients or services connected to the Internet or to a private network. DNS associates a domain name with an internet protocol address (IP). The information stored in the database is the domain and the date and time of the request, i.e. the complete URL is not consulted in any case. In addition, all stored data are anonymized.
There are approaches for analyzing mobile traffic based on domain information. However, relation between domains and applications is not bijective. Unique domains, i.e. domains exclusively accessed by an app, are the less frequent. Instead, there are some domains accessed by many apps. In the latter case, the knowledge of the domain does not univocally define the application.
There are also approaches for analyzing mobile traffic based on user agent. User agent presents two major drawbacks: not all HTTP petitions have user agent value, and applications developers decide the value of user agent field, so they can use another apps' user agent instead of setting their own.
Finally, there is a great variability in the requests of a concrete application. It is due, inter alia, to the different operating systems or mobile user devices (smartphones, tablets). Even different executions of the same application on the same terminal do not maintain the same request order. Some issues related to the requests variability are, to name but a few: request may be cached, latencies between requests vary depending on the mobile use, list of domains consulted by an app may vary between devices, or dynamic content include noise in executions.
Therefore, it is highly desirable to develop a method of apps detection from the mobile traffic which allows the MNOs to get a more precise user profile.