Journal of Digital Information Management Mario Barbareschi, Alessandra De Benedictis 13 4 2015 http://dline.info/fpaper/jdim/v13i4/v13i4_6.pdf Mobile traffic is significantly growing, thanks to the increased access capacity provided by 3G and 4G technologies and to the rising computing power of the latest smart devices. Due to the widespread diffusion of mobile applications that require and process sensitive customers data, mobile traffic is more and more subject to security attacks. Recently, traffic analysis techniques are being successfully adopted to characterize, from a security point of view, applications and networks behaviour in order to detect and avoid intrusion attempts, malware injections and data theft. When applied to the mobile domain, such techniques have to cope on the one hand with the performance constraints posed by the limited devices resources and, on the other hand, with the need for accurate and up-to-date traffic models, resulting from a continuous processing of meaningful traffic data and threat-related information. To face these issues, we propose a two-tier service-based traffic analysis infrastructure: at the mobile network layer, mobile devices run a high-accuracy hardware traffic analyser, which allows for the processing of large data sets in an energy-efficient way; at the service layer, a high-scale traffic analyser takes advantage of the correlation of traffic data involving heterogeneous and geographically distributed sources, in order to produce enhanced traffic models, which can be distributed to the devices in an on-demand fashion, according to the as-a- Service approach. To show the feasibility of our proposal, we provide a case study based on the implementation of a decision treebased traffic analyser on a Xilinx Zynq 7000 architecture,and present an overview of the service layer, by referring to a cloud infrastructure for its implementation.