Mobile Application Classification Using Layer 4 and 7 Signatures
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for mobile application classification are limited in their ability to improve over time due to technical constraints, leading to short-term classification retention and inefficiencies in identifying applications, especially those using encrypted traffic.
Innovation Solution
A method and system for mobile application classification that utilizes layer 4 and layer 7 information from input records, applying weighting to on-going classification status to enhance relevance, storing classifications in a persistent mobile context, and deriving signatures from both automatic and manual inspection of non-encrypted traffic to classify applications without decrypting encrypted traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of energy
If classifications are kept for short term due to technical constraints, then resource consumption is reduced, but classification accuracy improvement over time is limited
Solution Approach 1:
The classification system segments classification data into two categories: recent classifications (short-term) and historical classifications (long-term). This segmentation allows the system to retain only necessary recent classifications in active memory, reducing resource consumption, while still utilizing historical data for improving classification accuracy through periodic retraining of the classification model.
Solution Approach 2:
The system changes the temporal parameter of classification data retention by introducing a time-based differentiation between recent and historical classifications. By applying different retention strategies based on the age of classification data, the system optimizes the balance between resource consumption and accuracy improvement, allowing historical classifications to contribute to model enhancement without being permanently stored in active memory.
2Loss of information
If all past classifications are stored and considered equally, then comprehensive analysis is achieved, but recent classification patterns are diluted in the final classification
Solution Approach 1:
The system applies local quality by differentiating the weight or relevance of classification data based on its temporal location. Recent classifications are assigned higher relevance or weight in the final classification decision, while historical classifications provide contextual information but have reduced influence. This local differentiation ensures that the most current and relevant classification patterns dominate the final result.
Solution Approach 2:
The classification system implements dynamics by making the relevance of past classifications variable rather than static. The influence of historical classifications changes over time, with newer classifications progressively becoming more significant. This dynamic weighting mechanism allows the system to adapt to changing user behavior patterns while maintaining the benefit of historical data for rare or evolving application types.
3Measurement precision
If classification data is retained long term, then classification accuracy improves over time, but resource consumption increases
Solution Approach 1:
The system extracts only the essential features and patterns from historical classification data rather than storing complete raw classification records. By extracting and retaining only the most relevant classification characteristics and metadata needed for model retraining, the system reduces storage requirements while preserving the ability to improve classification accuracy through periodic retraining with historical patterns.
Data Source
Figure 1
Figure 2
AI summary
A method and a system to perform mobile application classification is described here wherein the method comprises obtaining from one or more input sources one or more input records, the input records containing layer 4 and layer 7 information; evaluating, by analyzing the one or more input records obtained from the one or more input sources, whether one or more of the input records have already been classified; if the one or more input records were not classified already, classifying the one or more input records by matching a set of signatures to the layer 4 and layer 7 information of the one or more input records; evaluating, whether one or more of the input records have been classified in a previous session and if so, marking them as past classifications, and if not, marking them as new classifications; storing, in a mobile context stored in a persistent storage, new classifications; generating an on-going classification status consisting of a set of possible applications by using the classified input records; storing, in the mobile context, the on-going classification status and generating a final classification as an output of the classification method, based on a combination of the on-going classification status and the past classifications.