Patent application EP17382279A (EP), filed 2017-05-16
Publication number: EP3404938A1
Title: METHOD FOR DETECTING APPLICATIONS OF MOBILE USER TERMINALS
Abstract: A method for detecting applications of mobile user terminals, comprising - parsing the files of an app to obtain the domains of its requests and splitting every domain into words to generate an app signature (1), - weighting (2) the words to obtain their frequency, - splitting the mobile traffic (3) into traffic blocks and splitting each traffic block (4) into words, - generating a traffic vector for each block by including its words and the repetition or frequency (5) of each word in the block, - comparing the generated traffic vectors with the generated signature (1) by applying the similarity method (6) to obtain the number of times that the signature (1) of each app is detected in the traffic vectors of a mobile terminal, - estimating a probability (7) of a user having each app installed in the mobile terminal, - applying a threshold (8) on the probability (7) to discard wrongly detected applications.
IPC codes: H04W   4/    02            A I
H04L  29/    08            A I
H04W   4/    00            A I
G06F  21/    56            A I
H04W   4/   029            A I
Claims: number: 1
text: A method for detecting applications of mobile user terminals, wherein each application generates a train of files associated with at least one mobile user terminal generating mobile user traffic, the train of files comprising requests to a set of Internet domains, the method characterized by comprising:
number: 2
text: The method according to any preceding claim, wherein applying the similarity method (6) results in a tern formed by the signature (1) of the application, the user and a value of similarity.
number: 3
text: The method according to any preceding claim, further comprising:
number: 4
text: The method according to any of claims 2-3, wherein estimating the probability (7) is applied on the tern resulted from the similarity method.
number: 5
text: The method according to any of claims 3-4, further comprising:
number: 6
text: The method according to claim 5, wherein the threshold is defined by means of a maximization of the F1-measure.
number: 7
text: The method according to any preceding claim, wherein the splitting of the obtained domain into words uses the dot as the splitting criteria.
number: 8
text: A computer program product comprising computer program code means adapted to perform all the steps of the method as defined in any of claims 1-7.
Office action: search_report, dated 2018-11-21
Rejection reasons: inventive_step_epc_56
Prior art cited: ref_id: - LI, B. ET AL.: "Intelligent Data Engineering and Automated Learning - IDEAL", vol. 8206, 2013, SPRINGER, article "Distance weighted cosine similarity measure for text classification", pages: 611 - 618
ref_type: npl
severity: background
ref_id: - POWERS, D. M.: "Evaluation: from precision, recall and F-measure to ROC, informedness, markedness and correlation", JOURNAL OF MACHINE LEARNING TECHNOLOGIES, vol. 2, no. 1, 2011, pages 37 - 63
ref_type: npl
severity: background
ref_id: US9633081B1
ref_type: patent
severity: background
ref_id: US2009282027A1
ref_type: patent
severity: background
ref_id: US2011029657A1
ref_type: patent
severity: background
ref_id: US2009282027
ref_type: patent
severity: obviousness
ref_id: US2011029657
ref_type: patent
severity: background
ref_id: US9633081
ref_type: patent
severity: obviousness
Final disposition: pending (2018-11-21)