A system provides monitoring for application usage on a device, such as a mobile device, using network consumption data of the device. The system determines an application list of applications executing on a device, determines application strings associated with the applications, receives network consumption data for a process executing on the device, and determines consumption data strings from the network consumption data. The system further determines match scores by identifying matching strings between the application strings and the consumption data strings along weighted search paths defined between the application strings and the consumption data strings, identifies an application from the application list for the process based on the match scores, and associates the network consumption data for the process with the application. The system generates usage data for the application by aggregating network consumption data associated with the application over time.