Robust Smartphone App Identification via Encrypted Network Traffic Analysis

By Vincent F. Taylor, Riccardo Spolaor, Mauro Conti, I. Martinovic. IEEE Transactions on Information Forensics and Security, 2017

356 citations recorded by the source corpus.

The apps installed on a smartphone can reveal much information about a user, such as their medical conditions, sexual orientation, or religious beliefs. In addition, the presence or absence of particular apps on a smartphone can inform an adversary, who is intent on attacking the device. In this paper, we show that a passive eavesdropper can feasibly identify smartphone apps by fingerprinting the network traffic that they send. Although SSL/TLS hides the payload of packets, side-channel data, such as packet size and direction is still leaked from encrypted connections. We use machine learning techniques to identify smartphone apps from this side-channel data. In addition to merely fingerprinting and identifying smartphone apps, we investigate how app fingerprints change over time, across devices, and across different versions of apps. In addition, we introduce strategies that enable our app classification system to identify and mitigate the effect of ambiguous traffic, i.e., traffic in common among apps, such as advertisement traffic. We fully implemented a framework to fingerprint apps and ran a thorough set of experiments to assess its performance. We fingerprinted 110 of the most popular apps in the Google Play Store and were able to identify them six months later with up to 96% accuracy. Additionally, we show that app fingerprints persist to varying extents across devices and app versions.

Subfields: Artificial Intelligence, Sociology and Political Science, Signal Processing

View Paper: https://www.semanticscholar.org/paper/50120028d83f4d2c69e56fa447fff87e3218f184

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Signal Processing

Citations in the corpus

FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic (2020, background): “Here, we compare our approach against AppScanner [62], a supervised state-of-theart technique to recognize apps in network traffic.”
Deep Learning for Encrypted Traffic Classification: An Overview (2018, background): “Note that some studies divide the entire flow into several bursts and then classify each burst to detect different user actions [5].”
ET-BERT: A Contextualized Datagram Representation with Pre-training Transformers for Encrypted Traffic Classification (2022, methodology): “To this end, some works [27, 36] extract the statistical feature and employ classical machine learning algorithms to handle the encrypted traffic without plaintext (Figure 1(b)).”
FS-Net: A Flow Sequence Network For Encrypted Traffic Classification (2019, methodology): “The general procedures include feature engineering and model training [5]–[8], [13].”
Mobile Encrypted Traffic Classification Using Deep Learning: Experimental Evaluation, Lessons Learned, and Challenges (2019, methodology): “Based on a dataset of real users’ activity (as opposed to [10], [13], [29], and [30], employing bot-generated mobile traffic), combination results present a performance gain according to all considered metrics.”