Robust Smartphone App Identification via Encrypted Network Traffic Analysis
Open accessAbstract
The apps installed on a smartphone can reveal much information about a user, such as their medical conditions, sexual orientation, or religious beliefs. In addition, the presence or absence of particular apps on a smartphone can inform an adversary, who is intent on attacking the device. In this paper, we show that a passive eavesdropper can feasibly identify smartphone apps by fingerprinting the network traffic that they send. Although SSL/TLS hides the payload of packets, side-channel data, such as packet size and direction is still leaked from encrypted connections. We use machine learning techniques to identify smartphone apps from this side-channel data. In addition to merely fingerprinting and identifying smartphone apps, we investigate how app fingerprints change over time, across devices, and across different versions of apps. In addition, we introduce strategies that enable our app classification system to identify and mitigate the effect of ambiguous traffic, i.e., traffic in common among apps, such as advertisement traffic. We fully implemented a framework to fingerprint apps and ran a thorough set of experiments to assess its performance. We fingerprinted 110 of the most popular apps in the Google Play Store and were able to identify them six months later with up to 96% accuracy. Additionally, we show that app fingerprints persist to varying extents across devices and app versions.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Statistical-feature-based encrypted traffic classification methods rely on expert-designed features that are hard to design generically and have limited generalization ability.
“These methods highly rely on expert-designed features and have limited generalization ability.”
From ET-BERT: A Contextualized Datagram Representation with Pre-training Transformers for Encrypted Traffic Classification (2022) · cites this paper as [36]
The Classifier section describes a classification method built from specified statistical features, supporting the point that it relies on designed features. The evaluation reports reduced accuracy when both device and app version change (Effect of a Different Device and Different App Versions), but also finds resilience across time and smaller effects from changing devices. The paper does not say that such features are hard to design generically or establish limited generalization as a general property of statistical-feature-based methods; page numbers were not available in our copy. (LLM, conf=0.83)
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Data Structures for Statistical Computing in Python
McKinney, W. (2010) · Proceedings of the Python in Science Conferences · doi:10.25080/majora-92bf1922-00a · Cited by 11,511 · cited 1× · see citing works
“These statistical features are computed using the Python pandas [32] library.”
MethodAPI design for machine learning software: experiences from the scikit-learn projectPreprint
Buitinck, L., Louppe, G., Blondel, M., Pedregosa, F., Mueller, A., Grisel, O., Niculae, V., Prettenhofer, P., Gramfort, A., Grobler, J., et al. (2013) · arXiv (Cornell University) · doi:10.48550/arxiv.1309.0238 · Cited by 2,387 · cited 1× · see citing works
“We leveraged the scikit-learn [34] machine learning libraries to implement the classifiers in our framework.”
MethodA survey of techniques for internet traffic classification using machine learning
Nguyen, T. T. T., & Armitage, G. (2008) · IEEE Communications Surveys & Tutorials · doi:10.1109/surv.2008.080406 · Cited by 1,664 · cited 1× · see citing works
“Network traffic fingerprinting is not a new area of research, and indeed the literature exemplifies techniques for network traffic classification on traditional computers [7].”
BackgroundDynodroid: an input generation system for Android apps
Machiry, A., Tahiliani, R., & Naik, M. (2013) · ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) · doi:10.1145/2491411.2491450 · Cited by 702 · see citing works
Website Fingerprinting at Internet Scale
Panchenko, A., Lanze, F., Zinnen, A., Henze, M., Pennekamp, J., Wehrle, K., & Engel, T. (2016) · Proceedings 2016 Network and Distributed System Security Symposium · doi:10.14722/ndss.2016.23477 · Cited by 645 · cited 1× · see citing works
“[17] present a website fingerprinting attack on Tor that outperforms related”
BackgroundWebsite fingerprinting in onion routing based anonymization networks
Panchenko, A., Niessen, L., Zinnen, A., & Engel, T. (2011) · ACM Workshop on Privacy in the Electronic Society (WPES) · doi:10.1145/2046556.2046570 · Cited by 508 · cited 1× · see citing works
“Similar work was proposed by Panchenko et al. [18].”
MethodPeek-a-Boo, I Still See You: Why Efficient Traffic Analysis Countermeasures Fail
Dyer, K. P., Coull, S. E., Ristenpart, T., & Shrimpton, T. (2012) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2012.28 · Cited by 478 · cited 3× · see citing works
“[16] presented web-page fingerprinting attacks and discussed their effectiveness despite traffic analysis countermeasures (e.”
BackgroundMethodInfluentialA first look at traffic on smartphones
Falaki, H., Lymberopoulos, D., Mahajan, R., Kandula, S., & Estrin, D. (2010) · ACM/SIGCOMM Internet Measurement Conference · doi:10.1145/1879141.1879176 · Cited by 453 · see citing works
Herrmann, D., Wendolsky, R., & Federrath, H. (2009) · doi:10.1145/1655008.1655013 · Cited by 423 · cited 1× · see citing works
“Subsequently, Herman et al. [17] outperformed Liberatore et al. by presenting a method that relies on common text mining techniques to the normalized frequency distribution of observable IP packet sizes.”
MethodTraffic Analysis: Protocols, Attacks, Design Issues, and Open Problems
Raymond, J.-F. (2001) · Lecture notes in computer science · doi:10.1007/3-540-44702-4_2 · Cited by 422 · cited 1× · see citing works
“With the advent of CDNs and standard web service APIs, more apps are sending their traffic to similar endpoints, and this frustrates attempts to fingerprint app traffic based on destination IP address only.”
BackgroundInferring the source of encrypted HTTP connections
Liberatore, M., & Levine, B. N. (2006) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/1180405.1180437 · Cited by 421 · cited 2× · see citing works
“[13] outperformed the aforementioned work by Liberatore and Levine [12] by presenting a method that relies on common text mining techniques performed over the normalized frequency distribution of observable IP packet sizes.”
BackgroundMethodAppScanner: Automatic Fingerprinting of Smartphone Apps from Encrypted Network Traffic
Taylor, V. F., Spolaor, R., Conti, M., & Martinović, I. (2016) · IEEE European Symposium on Security and Privacy · doi:10.1109/eurosp.2016.40 · Cited by 420 · cited 3× · see citing works
“In this paper we extend AppScanner, first presented by the authors in [8], along several important dimensions.”
BackgroundMethodInfluentialSelf-citationCai, X., Zhang, X. C., Joshi, B., & Johnson, R. (2012) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/2382196.2382260 · Cited by 394 · cited 1× · see citing works
“More recently, Cai et al. [19] presented a web page fingerprinting attack and showed its effectiveness despite traffic analysis countermeasures (e.g., HTTPOS).”
BackgroundAnalyzing Android Encrypted Network Traffic to Identify User Actions
Conti, M., Mancini, L., Spolaor, R., & Verde, N. V. (2016) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2015.2478741 · Cited by 275 · cited 1× · see citing works
“[28] and Saltaformaggio et al.”
Self-citationFingerprinting Websites Using Traffic Analysis
Hintz, A. S. (2003) · Lecture notes in computer science · doi:10.1007/3-540-36467-6_13 · Cited by 273 · cited 1× · see citing works
“Much work has been done on analysing traffic from work-stations and web browsers [9].”
BackgroundIndependent comparison of popular DPI tools for traffic classification
Bujlow, T., Carela-Español, V., & Barlet‐Ros, P. (2014) · Computer Networks · doi:10.1016/j.comnet.2014.11.001 · Cited by 245 · cited 1× · see citing works
“[9] do an independent comparison of traffic”
NetworkProfiler: Towards automatic fingerprinting of Android apps
Dai, S., Tongaonkar, A., Wang, X.-Y., Nucci, A., & Song, D. (2013) · 2013 Proceedings IEEE INFOCOM · doi:10.1109/infcom.2013.6566868 · Cited by 201 · cited 1× · see citing works
“[20] propose NetworkProfiler, an automated approach to profiling and identifying Android apps using dynamic methods.”
MethodQazi, Z. A., Lee, J., Jin, T., Bellala, G., Arndt, M., & Noubir, G. (2013) · ACM SIGCOMM Conference (SIGCOMM) · doi:10.1145/2486001.2491700 · Cited by 147 · cited 1× · see citing works
“[21] present Atlas, a framework for identifying apps using network flows.”
MethodPredicting user traits from a snapshot of apps installed on a smartphone
Seneviratne, S., Seneviratne, A. P., Mohapatra, P., & Mahanti, A. (2014) · ACM SIGMOBILE Mobile Computing and Communications Review · doi:10.1145/2636242.2636244 · Cited by 145 · cited 1× · see citing works
“As a result, the apps installed on typical smartphones may reveal sensitive information about a user’s medical conditions, hobbies, and sexual/religious preferences [6].”
BackgroundI know what you did on your smartphone: Inferring app usage over encrypted data traffic
Wang, Q., Yahyavi, A., Kemme, B., & He, W. (2015) · IEEE Conference on Communications and Network Security · doi:10.1109/cns.2015.7346855 · Cited by 111 · cited 1× · see citing works
“Wanget al. [22] propose a system for identifying smart-phone apps from encrypted 802.11 frames.”
BackgroundInfluentialCan Android Applications Be Identified Using Only TCP/IP Headers of Their Launch Time Traffic?
Alan, H. F., & Kaur, J. (2016) · Wireless Network Security · doi:10.1145/2939918.2939929 · Cited by 90 · cited 1× · see citing works
“Alan and Kaur [26] use TCP/IP headers for identifying apps.”
BackgroundA Web Traffic Analysis Attack Using Only Timing Information
Feghhi, S., & Leith, D. J. (2016) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2016.2551203 · Cited by 84 · cited 1× · see citing works
“…are some similarities, such as end-to-end communication using IP addresses/ports, there are nuances in the type of traffic sent by smartphones and the way in which it is sent that makes traffic analysis in the realm of smartphones distinct from traffic analysis on traditional workstations [10]–[13].”
BackgroundEavesdropping on fine-grained user activities within smartphone apps over encrypted network traffic
Saltaformaggio, B., Choi, H., Johnson, K., Kwon, Y., Zhang, Q., Zhang, X., Xu, D., & Qian, J. (2016) · Cited by 81 · see citing works
Le, A., Varmarken, J., Langhoff, S., Shuba, A., Gjoka, M., & Markopoulou, A. P. (2015) · doi:10.1145/2787394.2787396 · Cited by 79 · cited 1× · see citing works
“[22] propose AntMonitor, a system that also uses crowdsourcing but for the fine-grained collection of network data from Android devices.”
BackgroundTaylor, V. F., & Martinović, I. (2017) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3052973.3052990 · Cited by 50 · cited 1× · see citing works
“set of apps and identifying new versions of the same apps incurred a further performance penalty. This phenomenon is not unexpected, since apps routinely receive changes to their logic during updates [30], which may cause changes in their network traffic flows. However, our classification system shows that it is able to…”
BackgroundSelf-citationA study on Smart-phone traffic analysis
Lee, S., Park, J., Lee, H.-S., & Kim, M. (2011) · Asia-Pacific Network Operations and Management Symposium (APNOMS) · doi:10.1109/apnoms.2011.6077033 · Cited by 28 · see citing works
Enhancing the Performance of Mobile Traffic Identification with Communication Patterns
Mongkolluksamee, S., Visoottiviseth, V., & Fukuda, K. (2015) · IEEE Annual International Computer Software and Applications Conference (COMPSAC) · doi:10.1109/compsac.2015.50 · Cited by 18 · cited 1× · see citing works
“[24] [25] use packet size distribution and communication patterns for identifying mobile app traffic.”
BackgroundMongkolluksamee, S., Visoottiviseth, V., & Fukuda, K. (2016) · Journal of Information Processing · doi:10.2197/ipsjjip.24.247 · Cited by 14 · cited 1× · see citing works
“[24] [25] use packet size distribution and communication patterns for identifying mobile app traffic.”
BackgroundAnalysis of smartphone traffic with MapReduce
Yang, J., Zhang, S., Zhang, X., Liu, J., & Cheng, G. (2013) · Wireless and Optical Communications Conference · doi:10.1109/wocc.2013.6676399 · Cited by 5 · see citing works
Applicaion-level traffic analysis of smartphone users using embedded agents
Ham, H.-S., & Choi, M.-J. (2012) · Asia-Pacific Network Operations and Management Symposium (APNOMS) · doi:10.1109/apnoms.2012.6356057 · Cited by 4 · cited 1× · see citing works
“…are some similarities, such as end-to-end communication using IP addresses/ports, there are nuances in the type of traffic sent by smartphones and the way in which it is sent that makes traffic analysis in the realm of smartphones distinct from traffic analysis on traditional workstations [10]–[13].”
Background
Flagged first, then by citations
Research works printed but not linked: 2
- T. Stöber, M. Frank, J. Schmitt, and I. Martinovic, "Who do you sync you are?" in Proceedings of the sixth ACM conference on Security and privacy in wireless and mobile networks -WiSec '13. New York, New York, USA: ACM Press, Apr. 2013, p. 7. [Online]. Available: http://dl.acm.org/citation.cfm?id=2462096.2462099
- M. Conti, L. V. Mancini, R. Spolaor, and N. V. Verde, "Can't you hear me knocking: Identification of user actions on android apps via traffic analysis," ACM CODASPY, 2015.
Cited by
Sorted by citations
Deep Learning for Encrypted Traffic Classification: An Overview
Rezaei, S., & Liu, X. (2019) · IEEE Communications Magazine · doi:10.1109/mcom.2019.1800819 · Cited by 670 · see citing works
“Note that some studies divide the entire flow into several bursts and then classify each burst to detect different user actions [5].”
BackgroundLin, X., Xiong, G., Gou, G., Li, Z., Shi, J., & Yu, J. (2022) · Proceedings of the ACM Web Conference 2022 · doi:10.1145/3485447.3512217 · Cited by 599 · see citing works
“To this end, some works [27, 36] extract the statistical feature and employ classical machine learning algorithms to handle the encrypted traffic without plaintext (Figure 1(b)).”
BackgroundMethodInfluentialFS-Net: A Flow Sequence Network For Encrypted Traffic Classification
Liu, C., He, L., Xiong, G., Cao, Z., & Li, Z. (2019) · IEEE INFOCOM 2019 - IEEE Conference on Computer Communications · doi:10.1109/infocom.2019.8737507 · Cited by 630 · see citing works
“The general procedures include feature engineering and model training [5]–[8], [13].”
BackgroundMethodAceto, G., Ciuonzo, D., Montieri, A., & Pescapè, A. (2019) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2019.2899085 · Cited by 525 · see citing works
“Based on a dataset of real users’ activity (as opposed to [10], [13], [29], and [30], employing bot-generated mobile traffic), combination results present a performance gain according to all considered metrics.”
BackgroundMethodInfluentialMIMETIC: Mobile encrypted traffic classification using multimodal deep learning
Aceto, G., Ciuonzo, D., Montieri, A., & Pescapè, A. (2019) · Computer Networks · doi:10.1016/j.comnet.2019.106944 · Cited by 291 · see citing works
“cation and complexity standpoints) of MIMETIC approach and methodically compares it to existing (single-modality) DL alternatives [11, 13], approaches to fuse their information [21], and ML-based state-of-the-art in mobile TC [7].”
BackgroundMethodInfluentialA Survey on Encrypted Network Traffic Analysis Applications, Techniques, and Countermeasures
Papadogiannaki, E., & Ioannidis, S. (2021) · ACM Computing Surveys · doi:10.1145/3457904 · Cited by 297 · see citing works
“[147] Classification with Multi-Class Support Vector Machine (SVM), Multi-Class RF, Binary SVM, and Binary RF Precision, Recall, F1-score, Accuracy”
BackgroundMethodInfluentialFlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic
van Ede, T., Bortolameotti, R., Continella, A., Ren, J., Dubois, D. J., Lindorfer, M., Choffnes, D., van Steen, M., & Peter, A. (2020) · Proceedings 2020 Network and Distributed System Security Symposium · doi:10.14722/ndss.2020.24412 · Cited by 339 · see citing works
“Here, we compare our approach against AppScanner [62], a supervised state-of-theart technique to recognize apps in network traffic.”
BackgroundResultInfluentialMachine Learning-Powered Encrypted Network Traffic Analysis: A Comprehensive Survey
Shen, M., Ye, K., Liu, X., Zhu, L., Kang, J., Yu, S., Li, Q. L., & Xu, K. (2022) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2022.3208196 · Cited by 286 · see citing works
“[128] utilize a total of 54 statistical features to construct burst vectors, e.”
When Machine Learning Meets Privacy in 6G: A Survey
Sun, Y., Liu, J., Wang, J., Cao, Y., & Kato, N. (2020) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2020.3011561 · Cited by 211 · see citing works
“build a system which can feasibly identify smartphone Apps by fingerprinting their network traffic [149].”
BackgroundNetwork Intrusion Detection: Based on Deep Hierarchical Network and Original Flow Data
Zhang, Y., Chen, X., Jin, L., Wang, X., & Guo, D. (2019) · IEEE Access · doi:10.1109/access.2019.2905041 · Cited by 206 · see citing works
“(2) split: We use the SplitCap tool to split traffic packets with the same five-tupple information into a flow [25].”
MethodDISTILLER: Encrypted traffic classification via multimodal multitask deep learning
Aceto, G., Ciuonzo, D., Montieri, A., & Pescapè, A. (2021) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2021.102985 · Cited by 185 · see citing works
“For the sake of completeness, we touch upon other meaningful TC objects, however, adopted in the context of non-multitask encrypted TC such as the IP packet [16], HTTP session [27], and service burst [8].”
BackgroundMethodInfluentialMulti-classification approaches for classifying mobile app traffic
Aceto, G., Ciuonzo, D., Montieri, A., & Pescapè, A. (2017) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2017.11.007 · Cited by 181 · see citing works
Fine-Grained Webpage Fingerprinting Using Only Packet Length Information of Encrypted Traffic
Shen, M., Liu, Y., Zhu, L., Du, X., & Hu, J. (2020) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2020.3046876 · Cited by 154 · see citing works
“Motivated by [34], we calculate 18 statistical features (a total of 54 features) for each series: minimum (min), maximum (max), mean (mean), median absolute deviation (mad), standard deviation (std), variance (var ), skew (skew), kurtosis (kurt), percentiles (from 10% to 90%) ( per1-per9) and the number of elements (l…”
BackgroundMethodInfluentialToward effective mobile encrypted traffic classification through deep learning
Aceto, G., Ciuonzo, D., Montieri, A., & Pescapè, A. (2020) · Neurocomputing · doi:10.1016/j.neucom.2020.05.036 · Cited by 147 · see citing works
“Indeed, tuning γ enables a fine-grained control of the classifiers and further (useful) flexibility to mobile TC [11].”
BackgroundMethodInfluentialSmartphone App Usage Analysis: Datasets, Methods, and Applications
Li, T., Xia, T., Wang, H., Tu, Z., Tarkoma, S., Han, Z., & Hui, P. (2022) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2022.3163176 · Cited by 145 · see citing works
A Novel Multimodal Deep Learning Framework for Encrypted Traffic Classification
Lin, P., Ye, K., Hu, Y., Lin, Y., & Xu, C. (2022) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2022.3215507 · Cited by 135 · see citing works
“Appscanner is introduced in [20] and [21], which uses packet length vector to classify mobile applications.”
BackgroundA review on machine learning–based approaches for Internet traffic classification
Salman, O., Elhajj, I. H., Kayssi, A., & Chehab, A. (2020) · Annals of Telecommunications · doi:10.1007/s12243-020-00770-7 · Cited by 131 · see citing works
Sadeghzadeh, A. M., Shiravi, S., & Jalili, R. (2021) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2021.3052888 · Cited by 127 · see citing works
“After several studies in the domain of mobile application identification [26], [27], Aceto et al.”
BackgroundResultA Comprehensive Survey of Recent Internet Measurement Techniques for Cyber Security
Pour, M. S., Nader, C., Friday, K., & Bou-Harb, E. (2023) · Computers & security · doi:10.1016/j.cose.2023.103123 · Cited by 121 · see citing works
MaMPF: Encrypted Traffic Classification Based on Multi-Attribute Markov Probability Fingerprints
Liu, C., Cao, Z., Xiong, G., Gou, G., Yiu, S., & He, L. (2018) · International Workshop on Quality of Service · doi:10.1109/iwqos.2018.8624124 · Cited by 122 · see citing works
Large-Scale Mobile App Identification Using Deep Learning
Rezaei, S., Kroencke, B., & Liu, X. (2019) · IEEE Access · doi:10.1109/access.2019.2962018 · Cited by 116 · see citing works
“Identifying ambiguous traffic (i.e. labeling them as ambiguous ) is shown to be possible [5].”
BackgroundMethodResultInfluentialSeeing Traffic Paths: Encrypted Traffic Classification With Path Signature Features
Xu, S., Geng, G., Jin, X., Liu, D., & Weng, J. (2022) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2022.3179955 · Cited by 111 · see citing works
App-Net: A Hybrid Neural Network for Encrypted Mobile Traffic Classification
Wang, X., Chen, S., & Su, J. (2020) · IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS) · doi:10.1109/infocomwkshps50562.2020.9162891 · Cited by 110 · see citing works
“Multiple conventional ML classifiers have been proven successful in encrypted mobile traffic classification (EMTC) [2]–[4].”
BackgroundOptimizing Feature Selection for Efficient Encrypted Traffic Classification: A Systematic Approach
Shen, M., Liu, Y., Zhu, L., Xu, K., Du, X., & Guizani, N. (2020) · IEEE Network · doi:10.1109/mnet.011.1900366 · Cited by 109 · see citing works
“Note that while some existing traffic analysis schemes [8] also considered evaluating feature contribution, there are several obvious differences between the proposed method in this article and the existing methods.”
BackgroundMethodInfluentialNetmamba: Efficient Network Traffic Classification Via Pre-Training Unidirectional Mamba
Wang, T., Xie, X., Wang, W., Wang, C., Zhao, Y., & Cui, Y. (2024) · IEEE International Conference on Network Protocols (ICNP) · doi:10.1109/icnp61940.2024.10858569 · Cited by 115 · see citing works
TrafficFormer: An Efficient Pre-trained Model for Traffic Data
Zhou, G., Guo, X., Liu, Z., Li, T., Li, Q., & Xu, K. (2025) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp61157.2025.00102 · Cited by 98 · see citing works
“Machine learning-based methods [36], [37], [38], [39], [40] rely on expert-designed statistical features of traffic, which are fed into models for training.”
InfluentialThe Dark Side(-Channel) of Mobile Devices: A Survey on Network Traffic Analysis
Conti, M., Li, Q.-Q., Maragno, A., & Spolaor, R. (2017) · IEEE Communications Surveys and Tutorials · doi:10.1109/comst.2018.2843533 · Cited by 97 · see citing works
Self-citationMIRAGE: Mobile-app Traffic Capture and Ground-truth Creation
Aceto, G., Ciuonzo, D., Montieri, A., Persico, V., & Pescapè, A. (2019) · International Conference on Computing, Communication and Security (ICCCS) · doi:10.1109/cccs.2019.8888137 · Cited by 93 · see citing works
“Previous works in the field of traffic classification via machine learning successfully leveraged these features to feed the classification algorithms they devised [16, 21–23].”
BackgroundCharacterization and Prediction of Mobile-App Traffic Using Markov Modeling
Aceto, G., Bovenzi, G., Ciuonzo, D., Montieri, A., Persico, V., & Pescapè, A. (2021) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2021.3051381 · Cited by 83 · see citing works
“traffic, which evolves at fast pace [9], [10].”
BackgroundA Dive into the Dark Web: Hierarchical Traffic Classification of Anonymity Tools
Montieri, A., Ciuonzo, D., Bovenzi, G., Persico, V., & Pescapè, A. (2019) · IEEE Transactions on Network Science and Engineering · doi:10.1109/tnse.2019.2901994 · Cited by 82 · see citing works
“This design choice—already introduced and justified in the mobile context in a flat scenario [28]—here avoids that misclassifications are propagated downwards, at the expense of coarsergrained predictions.”
BackgroundEBSNN: Extended Byte Segment Neural Network for Network Traffic Classification
Xiao, X., Xiao, W., Li, R., Luo, X., Zheng, H.-T., & Xia, S. (2021) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2021.3101311 · Cited by 80 · see citing works
“Besides, Taylor et al. implemented an application classifi-cation framework [13], which exploits statistical features of the packet length sequence, to fingerprint smartphone applications.”
BackgroundHEDGE: Efficient Traffic Classification of Encrypted and Compressed Packets
Casino, F., Choo, K.-K. R., & Patsakis, C. (2019) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2019.2911156 · Cited by 73 · see citing works
“By analysing the features and characteristics of traffic flows, including encrypted traffic flows, one may be able to identify specific user behaviours [7, 48].”
BackgroundATVITSC: A Novel Encrypted Traffic Classification Method Based on Deep Learning
Liu, Y., Wang, X., Qu, B., & Zhao, F. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3433446 · Cited by 75 · see citing works
EC-GCN: A encrypted traffic classification framework based on multi-scale graph convolution networks
Diao, Z.-L., Xie, G.-G., Wang, X., Ren, R., Meng, X.-Y., Zhang, G.-X., Xie, K., & Qiao, M. (2023) · Comput. Networks · doi:10.1016/j.comnet.2023.109614 · Cited by 70 · see citing works
Rago, A., Piro, G., Boggia, G., & Dini, P. (2020) · IEEE Transactions on Vehicular Technology · doi:10.1109/tvt.2020.3005724 · Cited by 67 · see citing works
“of encrypted communication flows [40]–[43].”
Real Network Traffic Collection and Deep Learning for Mobile App Identification
Wang, X., Chen, S., & Su, J. (2020) · Wireless Communications and Mobile Computing · doi:10.1155/2020/4707909 · Cited by 67 · see citing works
“*is method is proposed in [4, 5], which represents the state-of-the-art mobile traffic classifier using traditional machine learning techniques.”
BackgroundMethodInfluentialDeep learning for encrypted traffic classification in the face of data drift: An empirical study
Malekghaini, N., Akbari, E., Salahuddin, M. A., Limam, N., Boutaba, R., Mathieu, B., Moteau, S., & Tuffin, S. (2023) · Computer Networks · doi:10.1016/j.comnet.2023.109648 · Cited by 65 · see citing works
“Although the work in [30] is based on traditional ML models, it relates to our work in the recognition of the effect of ambiguous flows in confounding the classifier, as well as confirming the phenomenon of model decay in mobile app fingerprinting.”
MethodInfluentialPham, T., Ho, T., Truong-Huu, T., Cao, T.-D., & Truong, H.-L. (2021) · Asia-Pacific Computer Systems Architecture Conference · doi:10.1145/3485832.3485925 · Cited by 69 · see citing works
“As apps use CDNs or shared services, similar flow characteristics will be observed, thus confusing the classification model [40, 41, 44].”
BackgroundMachine Learning for Traffic Analysis: A Review
Alqudah, N., & Yaseen, Q. M. (2020) · Procedia Computer Science · doi:10.1016/j.procs.2020.03.111 · Cited by 60 · see citing works
BFCN: A Novel Classification Method of Encrypted Traffic Based on BERT and CNN
Shi, Z., Luktarhan, N., Song, Y., & Tian, G. (2023) · Electronics · doi:10.3390/electronics12030516 · Cited by 60 · see citing works
“Port-based N/A Fingerprint construction Deep Packet Inspection (DPI) [9], FlowPrint [6] Statistical methods AppScanner [16], BIND [17] Deep learning model DF [18], FS-NET [19], DeepPacket [9], TSCRNN [20] Pretraining models PERT [23], CDB [24], ET-BERT [8]”
MethodAccurate mobile-app fingerprinting using flow-level relationship with graph neural networks
Jiang, M., Li, Z., Fu, P., Cai, W., Cui, M.-X., Xiong, G., & Gou, G.-P. (2022) · Comput. Networks · doi:10.1016/j.comnet.2022.109309 · Cited by 49 · see citing works
Procedures, Criteria, and Machine Learning Techniques for Network Traffic Classification: A Survey
Sheikh, M. S., & Peng, Y. (2022) · IEEE Access · doi:10.1109/access.2022.3181135 · Cited by 59 · see citing works
“They also assessed the performance of the present method against other classifiers such as Web traffic [156] and VoIP [157].”
MethodDevice Fingerprinting for Cyber-Physical Systems: A Survey
Kumar, V., & Paul, K. (2023) · ACM Computing Surveys · doi:10.1145/3584944 · Cited by 55 · see citing works
“In [83, 189, 199], the author uses DFP for device identiication, which is unique, strong, and hard to change.”
BackgroundMethodDE-GNN: Dual embedding with graph neural network for fine-grained encrypted traffic classification
Han, X., Xu, G., Zhang, M., Yang, Z., Yu, Z., Huang, W.-Q., & Meng, C. (2024) · Comput. Networks · doi:10.1016/j.comnet.2024.110372 · Cited by 56 · see citing works
Hang, Z., Lu, Y.-L., Wang, Y., & Xie, Y. (2023) · International Symposium on Recent Advances in Intrusion Detection · doi:10.1145/3607199.3607206 · Cited by 66 · see citing works
“Twelve state-of-the-art generic malicious traffic detection methods are utilized as baselines: AppScanner [45], CU-MUL [33], BIND [1], K-fp [14], FlowPrint [47], DF [41], FS-Net [29], GraphDApp [40], TSCRNN [26], Deeppacket [31], PERT [15], and ET-BERT [27].”
BackgroundMethodFine-grained TLS services classification with reject option
Luxemburk, J., & Čejka, T. (2022) · Computer Networks · doi:10.1016/j.comnet.2022.109467 · Cited by 53 · see citing works
“This approach was justified in [23] for the task of identifying mobile apps.”
Traffic Fingerprinting Attacks on Internet of Things Using Machine Learning
Skowron, M., Janicki, A., & Mazurczyk, W. (2020) · IEEE Access · doi:10.1109/access.2020.2969015 · Cited by 53 · see citing works
An Encrypted Traffic Classification Method Combining Graph Convolutional Network and Autoencoder
Sun, B., Yang, W., Yan, M.-Q., Wu, D.-H., Zhu, Y., & Bai, Z. (2020) · IEEE International Performance, Computing, and Communications Conference · doi:10.1109/ipccc50635.2020.9391542 · Cited by 53 · see citing works
“To overcome the problem that rule-based methods cannot handle encrypted traffic, the Machine Learning (ML)-based methods become the mainstream method for encrypted traffic classification [7]–[10], which combine flow-statistics and machine learning algorithms.”
Method$BitCoding$ : Network Traffic Classification Through Encoded Bit Level Signatures
Hubballi, N., & Swarnkar, M. (2018) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2018.2868816 · Cited by 47 · see citing works
“This task of identifying the application to which an aggregate set of packets belong to is known as traffic classification [8], [24].”
BackgroundPath signature-based XAI-enabled network time series classification
Sun, L., Wang, Y., Ren, Y., & Xia, F. (2024) · Science China Information Sciences · doi:10.1007/s11432-023-3978-y · Cited by 46 · see citing works
Exploiting Diversity in Android TLS Implementations for Mobile App Traffic Classification
Sengupta, S., Ganguly, N., De, P., & Chakraborty, S. (2019) · The World Wide Web Conference · doi:10.1145/3308558.3313738 · Cited by 45 · see citing works
“Tool for side-channel attacks: It follows from the previous discussion, therefore, that along with packet-level and traffic meta-data (e.g., direction of traffic) based features [17, 45, 48], bit-sequence based features can also pose threats via side-channel attacks.”
BackgroundKnow your Big Data Trade-offs when Classifying Encrypted Mobile Traffic with Deep Learning
Aceto, G., Ciuonzo, D., Montieri, A., Persico, V., & Pescapè, A. (2019) · Network Traffic Measurement and Analysis Conference (TMA) · doi:10.23919/tma.2019.8784565 · Cited by 45 · see citing works
“domain-expert driven) features, which in TC context usually correspond to statistics extracted from the sequence of packets [7] or exchanged messages [9].”
BackgroundInfluentialPacket-level prediction of mobile-app traffic using multitask Deep Learning
Montieri, A., Bovenzi, G., Aceto, G., Ciuonzo, D., Persico, V., & Pescapè, A. (2021) · Computer Networks · doi:10.1016/j.comnet.2021.108529 · Cited by 45 · see citing works
Packet-Level Open-World App Fingerprinting on Wireless Traffic
Li, J.-F., Wu, S., Zhou, H., Luo, X.-P., Wang, T., Liu, Y., & Ma, X. (2022) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2022.24210 · Cited by 47 · see citing works
Efficient Fine-Grained Website Fingerprinting via Encrypted Traffic Analysis with Deep Learning
Shen, M., Gao, Z., Zhu, L., & Xu, K. (2021) · International Workshop on Quality of Service · doi:10.1109/iwqos52092.2021.9521272 · Cited by 44 · see citing works
“Statistical features such as maximum, minimum, and average length, are also used for fingerprinting [6, 9, 17].”
BackgroundMethodEncrypted Traffic Classification Based on Text Convolution Neural Networks
Song, M., Jing, R., & Li, S. (2019) · International Conference on Computer Science and Network Technology (ICCSNT) · doi:10.1109/iccsnt47585.2019.8962493 · Cited by 42 · see citing works
“[1] The size of the data packet in a stream is used to compose feature vectors, and the minimum, maximum, average, median, absolute deviation, standard deviation, variance, skew, kurtosis, percentile in the feature vector are calculated as statistical features.”
MethodA Two-Phase Approach to Fast and Accurate Classification of Encrypted Traffic
Wang, Y.-P., He, H., Lai, Y., & Liu, A. X. (2023) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2022.3209979 · Cited by 34 · see citing works
“Prior schemes based on flow statistical features [9], [10], [11], [12] generally use the typical summary statistics taken/evaluated from an entire bidirectional flow (e.”
BackgroundReliability for Smart Healthcare: A Network Slicing Perspective
Vergütz, A., Noubir, G., & Nogueira, M. (2020) · IEEE Network · doi:10.1109/mnet.011.1900458 · Cited by 41 · see citing works
“The framework fingerprints network traffic test other fingerprinting approaches to improve the accuracy and implement the network slices”
MethodMalDIST: From Encrypted Traffic Classification to Malware Traffic Detection and Classification
Bader, O., Lichy, A., Hajaj, C., Dubin, R., & Dvir, A. Z. (2022) · IEEE Consumer Communications and Networking Conference · doi:10.1109/ccnc49033.2022.9700625 · Cited by 41 · see citing works
Combating Imbalance in Network Traffic Classification Using GAN Based Oversampling
Guo, Y., Xiong, G., Li, Z., Shi, J., Cui, M., & Gou, G. (2021) · IFIP Networking Conference (IFIP Networking) · doi:10.23919/ifipnetworking52078.2021.9472777 · Cited by 40 · see citing works
“This results in the performance of existing MLbased NTC schemes being greatly degraded when facing realworld imbalanced traffic classification tasks [3], [6], [13]–[16].”
BackgroundGuarino, I., Aceto, G., Ciuonzo, D., Montieri, A., Persico, V., & Pescapè, A. (2022) · Computer Networks · doi:10.1016/j.comnet.2022.109452 · Cited by 40 · see citing works
“Aiolli et al. [34] focus on identifying user activities on smartphone-based Bitcoin wallet apps , leveraging the earlier methodology proposed in [35].”
MethodOnline multimedia traffic classification from the QoS perspective using deep learning
Wu, Z., Dong, Y., Qiu, X., & Jin, J. (2022) · Computer Networks · doi:10.1016/j.comnet.2021.108716 · Cited by 39 · see citing works
Yang, J., Jiang, X., Lei, Y., Liang, W., Ma, Z., & Li, S. (2024) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2024.3383851 · Cited by 38 · see citing works
Automatic Mobile App Identification From Encrypted Traffic With Hybrid Neural Networks
Wang, X., Chen, S., & Su, J. (2020) · IEEE Access · doi:10.1109/access.2020.3029190 · Cited by 38 · see citing works
“Most previously proposed APP-ID solutions report performance with results based on private datasets which are labeled by approaches of unknown reliability [4]–[6], [10]–[12], [20].”
BackgroundInfluentialPractical Traffic Analysis Attacks on Secure Messaging Applications
Bahramali, A., Houmansadr, A., Soltani, R., Goeckel, D., & Towsley, D. (2020) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2020.24347 · Cited by 45 · see citing works
“Side channel attacks Another class of traffic analysis attacks aims at leaking sensitive information from encrypted network traffic of Internet services [6], [10], [13], [19], [33], [77], [82], [95].”
BackgroundSoK: Decoding the Enigma of Encrypted Network Traffic Classifiers
Wickramasinghe, N. C., Shaghaghi, A., Tsudik, G., & Jha, S. K. (2025) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp61157.2025.00165 · Cited by 36 · see citing works
Rethinking Encrypted Traffic Classification: A Multi-Attribute Associated Fingerprint Approach
Chen, Y., Zang, T., Zhang, Y., Zhou, Y. J., & Wang, Y. (2019) · IEEE International Conference on Network Protocols (ICNP) · doi:10.1109/icnp.2019.8888043 · Cited by 36 · see citing works
“In general, we can generate mobile application traces by adopting Monkeyrunner [23] to fuzz the user interface (UI) of the applications [24], [25] or by employing volunteers to manually operate the applications.”
MethodDeep Learning for Encrypted Traffic Classification and Unknown Data Detection
Pathmaperuma, M. H., Rahulamathavan, Y., Dogan, S., & KONDOZ, A. M. (2022) · Sensors · doi:10.3390/s22197643 · Cited by 34 · see citing works
Effective DDoS Mitigation via ML-Driven In-Network Traffic Shaping
Zhao, Z., Liu, Z., Chen, H., Zhang, F., Song, Z., & Li, Z. (2024) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2023.3349180 · Cited by 35 · see citing works
“These approachescanbegenerallycategorizedintostatistical-based methods[66],[67],[68],sequence-basedapproaches[32],[69], [70],andothers[18],[71],[72]thatuseDNNstodetecttraffic.”
Saeed, A., & Kolberg, M. (2018) · IEEE Access · doi:10.1109/access.2018.2888813 · Cited by 33 · see citing works
“[38] has suggested the alternative method in which a system is used to identify smartphone applications, which are encrypted through 802.”
MethodA Big Data-Enabled Hierarchical Framework for Traffic Classification
Bovenzi, G., Aceto, G., Ciuonzo, D., Persico, V., & Pescapè, A. (2020) · IEEE Transactions on Network Science and Engineering · doi:10.1109/tnse.2020.3009832 · Cited by 32 · see citing works
“Leveraging Machine Learning (ML) approaches to accomplish this task also fulfills the requirement of preserving privacy by performing the classification solely based on the statistical features of the encrypted traffic, without decrypting its content [3].”
BackgroundIdentification of Encrypted Video Streaming Based on Differential Fingerprints
Wu, H., Yu, Z., Cheng, G., & Guo, S. (2020) · IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS) · doi:10.1109/infocomwkshps50562.2020.9162914 · Cited by 32 · see citing works
“In recent years, for different purposes, there have been many types of researches on encrypted traffic, including the identification of encrypted traffic [8], malicious attacks [9] [10] [11], types of application [12] [13] [14], video service providers [15], and video QoE [16] [17] [18].”
BackgroundIncremental Learning for Mobile Encrypted Traffic Classification
Chen, Y., Zang, T., Zhang, Y., Zhou, Y. J., Ouyang, L., & Yang, P. (2021) · International Conference on Communications · doi:10.1109/icc42927.2021.9500619 · Cited by 32 · see citing works
“first design the burst and flow statistical features and propose an encryption-agnostic framework AppScanner to fingerprint mobile applications [4].”
BackgroundGCN-ETA: High-Efficiency Encrypted Malicious Traffic Detection
Zheng, J., Zeng, Z., & Feng, T. (2022) · Security and Communication Networks · doi:10.1155/2022/4274139 · Cited by 32 · see citing works
Identifying WeChat Red Packets and Fund Transfers Via Analyzing Encrypted Network Traffic
Yan, F., Xu, M., Qiao, T., Wu, T., Yang, X. S., Zheng, N., & Choo, K. R. (2018) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom/bigdatase.2018.00198 · Cited by 30 · see citing works
“It practice, 95% of packets on smartphones are received or transmitted within one second (time span) of the previous packet in most current network environment (see [21] for instance).”
BackgroundTransparent and Service-Agnostic Monitoring of Encrypted Web Traffic
Brissaud, P.-O., François, J., Chrisment, I., Cholez, T., & Bettan, O. (2019) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2019.2933155 · Cited by 29 · see citing works
“[19] can profile 110 mobile applications with an accuracy between 73% and 96%.”
BackgroundTrojanFlow: A Neural Backdoor Attack to Deep Learning-based Network Traffic Classifiers
Ning, R., Xin, C., & Wu, H. (2022) · IEEE Conference on Computer Communications (INFOCOM) · doi:10.1109/infocom48880.2022.9796878 · Cited by 29 · see citing works
“To tackle this problem, a few efforts have been made in the research community to identify encrypted network traffic using machine learning (ML) techniques [11]–[13], where ML”
BackgroundAiolli, F., Conti, M., Gangwal, A., & Polato, M. (2019) · ACM Symposium on Applied Computing · doi:10.1145/3297280.3297430 · Cited by 29 · see citing works
“Taylor et al. [27] showed that a passive eavesdropper can recognize Android apps by fingerprinting network traffic.”
BackgroundSelf-citationTSFN: A Novel Malicious Traffic Classification Method Using BERT and LSTM
Shi, Z., Luktarhan, N., Song, Y., & Yin, H. (2023) · Entropy · doi:10.3390/e25050821 · Cited by 22 · see citing works
“Fingerprint construction approach FlowPrint [7] Statistical feature approached AppScanner [12], CUMUL [29], BIND [13], k-fingerprinting (K-fp) [30] Deep learning approaches Deep Fingerprinting (DF) [14], FS-Net [15], GraphDApp [31], TSCRNN [17], Deeppacket [16], wang [5] pre-training approaches PERT…”
Unmasking the Internet: A Survey of Fine-Grained Network Traffic Analysis
Feng, Y., Li, J., Mirkovic, J., Wu, C., Wang, C., Ren, H., Xu, J.-H., & Liu, Y. (2025) · IEEE Communications Surveys and Tutorials · doi:10.1109/comst.2025.3545541 · Cited by 36 · see citing works
Android Spyware Detection Using Machine Learning: A Novel Dataset
Qabalin, M. K., Naser, M., & Alkasassbeh, M. S. (2022) · Sensors · doi:10.3390/s22155765 · Cited by 28 · see citing works
“[29] Generic dataset Network traffic-based Machine learning-based”
Lin, X.-J., He, L.-T., Gou, G.-P., Yu, J., Guan, Z., Li, X., Guo, J., & Xiong, G. (2024) · Computers & security · doi:10.1016/j.cose.2024.103892 · Cited by 24 · see citing works
USB powered devices: A survey of side-channel threats and countermeasures
Liu, H., Spolaor, R., Turrin, F., Bonafede, R., & Conti, M. (2021) · High-Confidence Computing · doi:10.1016/j.hcc.2021.100007 · Cited by 27 · see citing works
Self-citationPacket Representation Learning for Traffic Classification
Meng, X., Wang, Y., Ma, R., Luo, H., Li, X., & Zhang, Y. (2022) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3534678.3539085 · Cited by 26 · see citing works
“• APPS [21]: This method learns to select representative features, and utilize them with a random tree classi er for application classi cation.”
MethodOTTer: A Scalable High-Resolution Encrypted Traffic Identification Engine
Papadogiannaki, E., Halevidis, C., Akritidis, P., & Koromilas, L. (2018) · Lecture notes in computer science · doi:10.1007/978-3-030-00470-5_15 · Cited by 26 · see citing works
BitProb: Probabilistic Bit Signatures for Accurate Application Identification
Hubballi, N., Swarnkar, M., & Conti, M. (2020) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2020.2999856 · Cited by 26 · see citing works
“NETWORK traffic classification [1], [2] is a technique that identifies the application or protocol by inspecting network packets.”
MethodSelf-citationHe, Y. M., He, Q., Fang, S., & Liu, Y. (2021) · International Conference on Mobile Systems, Applications, and Services · doi:10.1145/3458864.3467683 · Cited by 25 · see citing works
“Traffic Analysis: Traffic analysis can achieve various applications, including detecting drones [31, 35], inferring apps [36, 38], monitoring misbehaving apps [42], enforcing network access restrictions [14], identifying actions on apps [11], and detecting hidden wireless cameras [10].”
BackgroundYang, L., Guo, S., Liu, D., Zeng, Y. W., Jiao, X., & Zhou, Y. (2024) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2024.3383218 · Cited by 24 · see citing works
Identifying Known and Unknown Mobile Application Traffic Using a Multilevel Classifier
Zhao, S., Chen, S., Sun, Y., Cai, Z., & Su, J. (2019) · Security and Communication Networks · doi:10.1155/2019/9595081 · Cited by 24 · see citing works
Acceleration of Intrusion Detection in Encrypted Network Traffic Using Heterogeneous Hardware
Papadogiannaki, E., & Ioannidis, S. (2021) · Sensors · doi:10.3390/s21041140 · Cited by 24 · see citing works
“…we believe that typical string pattern matching for packet payload content inspection should be integrated with our proposed packet metadata matching for more mature and effective intrusion detection systems, even if techniques like encryption and traffic analysis resistance can circumvent them.”
BackgroundA Large-Scale Mobile Traffic Dataset For Mobile Application Identification
Zhao, S., Chen, S., Wang, F., Wei, Z.-L., Zhong, J., & Liang, J. (2023) · Computer/law journal · doi:10.1093/comjnl/bxad076 · Cited by 27 · see citing works
BOTection: Bot Detection by Building Markov Chain Models of Bots Network Behavior
Alahmadi, B., Mariconti, E., Spolaor, R., Stringhini, G., & Martinović, I. (2020) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3320269.3372202 · Cited by 24 · see citing works
Self-citationTHE ROLE OF SOCIAL MEDIA IN THE PROCESS OF INFORMING THE PUBLIC ABOUT DISASTER RISKS
Cvetković, V. M., Nikolic, A., & Ivanov, A. (2023) · Journal of Liberty and International Affairs Institute for Research and European Studies - Bitola · doi:10.47305/jlia2392121c · Cited by 25 · see citing works
Let model keep evolving: Incremental learning for encrypted traffic classification
Li, X., Xie, J., Song, Q., Sang, Y.-F., Zhang, Y., Li, S.-H., & Zang, T. (2023) · Computers & security · doi:10.1016/j.cose.2023.103624 · Cited by 22 · see citing works
Nearby Threats: Reversing, Analyzing, and Attacking Google's 'Nearby Connections' on Android
Antonioli, D., Tippenhauer, N. O., & Rasmussen, K. (2019) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2019.23367 · Cited by 21 · see citing works
“The attacker then can perform traffic analysis even on encrypted packets [35].”
BackgroundMEMG: Mobile Encrypted Traffic Classification With Markov Chains and Graph Neural Network
Cai, W., Gou, G., Jiang, M., Liu, C., Xiong, G., & Li, Z. (2021) · IEEE International Conference on High Performance Computing and Communications; IEEE International Conference on Smart City; IEEE International Conference on Data Science and Systems (HPCC/SmartCity/DSS) · doi:10.1109/hpcc-dss-smartcity-dependsys53884.2021.00087 · Cited by 21 · see citing works
Luo, P., Chu, J., & Yang, G. (2023) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2023.103519 · Cited by 21 · see citing works
Extreme SDN Framework for IoT and Mobile Applications Flexible Privacy at the Edge
Uddin, M., Nadeem, T., & Nukavarapu, S. K. (2019) · IEEE International Conference on Pervasive Computing and Communications · doi:10.1109/percom.2019.8767413 · Cited by 21 · see citing works
“encrypted overlapping traffic into individual applications and then apply the side-channel attack on each class to fingerprint and identify individual applications [37], [38].”
BackgroundA communication-channel-based method for detecting deeply camouflaged malicious traffic
Fang, Y., Li, K., Zheng, R., Liao, S., & Wang, Y. (2021) · Computer Networks · doi:10.1016/j.comnet.2021.108297 · Cited by 20 · see citing works
Bovenzi, G., Cerasuolo, F., Montieri, A., Nascita, A., Persico, V., & Pescapè, A. (2022) · IEEE Symposium on Computers and Communications (ISCC) · doi:10.1109/iscc55528.2022.9912986 · Cited by 20 · see citing works
“results [9, 12, 25, 27], namely: min, max, mean, standard deviation, variance, mean absolute deviation, skewness, kurtosis, and 10 to 90 percentiles.”
- Authors
- Taylor, V. F., Spolaor, R., Conti, M., & Martinovic, I.
- Affiliations
- University of Oxford (GB)
- University of Padua (IT)
- Venue
- IEEE Transactions on Information Forensics and Security
- Published
- 2018-01
- Volume
- 13
- Issue
- 1
- Pages
- 63-78
- ISSN
- 1556-6013 (ISSN-L)
- 1556-6021
- OpenAlex
- W2609737443
- Cited by
- 439
- References
- 30
- Citations by year
- 2026: 47 · 2025: 69 · 2024: 63 · 2023: 55 · 2022: 60 · 2021: 45 · 2020: 41 · 2019: 39 · 2018: 18 · 2017: 1 · 2016: 1
- FWCI
- 16.15
- Type
- journal article
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- IEEE Transactions on Information Forensics and Security (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- Padua Research Archive (University of Padova) (submittedVersion, other-oa)
- arXiv (Cornell University)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Physical Sciences › Computer Science › Information Systems › Digital and Cyber Forensics
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Keywords
- encrypted traffic analysis, packet size, SSL/TLS, passive eavesdropping, privacy leakage
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
