WhatApp: Modeling mobile applications by domain names
Wei Wang, Jeffrey Bickford · 2016
Characterizing mobile traffic is important to network operators from a network performance and security standpoint. In many cases, such as a performance degradation or security threat, it is useful to know that traffic is being generated by a specific mobile application. Recent methods for identifying mobile traffic have relied on computationally expensive detailed inspection of HTTP flows which may not scale across large networks. This paper proposes a lightweight method to generate a probabilistic model of an application based on a distribution of domain names. We observe that a large portion of mobile applications have traffic to domain names that are critical to how the application functions. Network operators can use this model to verify if a set of one or more domain names is associated with a mobile application during a performance issue or security event. Based on analysis of real mobile network traffic, the model can correctly correlate domain names with associated applications at a rate of 90% in various scenarios. These results show that identifying applications by domain names via this lightweight solution is feasible and merits continued future work.