The DOI matches its Crossref record, with a small difference in title or year; 30 of the 30 references it cites were found in a registry or an index.
Robust Smartphone App Identification via Encrypted Network Traffic Analysis
Open accessAbstract
The apps installed on a smartphone can reveal much information about a user, such as their medical conditions, sexual orientation, or religious beliefs. In addition, the presence or absence of particular apps on a smartphone can inform an adversary, who is intent on attacking the device. In this paper, we show that a passive eavesdropper can feasibly identify smartphone apps by fingerprinting the network traffic that they send. Although SSL/TLS hides the payload of packets, side-channel data, such as packet size and direction is still leaked from encrypted connections. We use machine learning techniques to identify smartphone apps from this side-channel data. In addition to merely fingerprinting and identifying smartphone apps, we investigate how app fingerprints change over time, across devices, and across different versions of apps. In addition, we introduce strategies that enable our app classification system to identify and mitigate the effect of ambiguous traffic, i.e., traffic in common among apps, such as advertisement traffic. We fully implemented a framework to fingerprint apps and ran a thorough set of experiments to assess its performance. We fingerprinted 110 of the most popular apps in the Google Play Store and were able to identify them six months later with up to 96% accuracy. Additionally, we show that app fingerprints persist to varying extents across devices and app versions.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“These methods highly rely on expert-designed features and have limited generalization ability.”
From ET-BERT: A Contextualized Datagram Representation with Pre-training Transformers for Encrypted Traffic Classification (2022) · cites this paper as [36]
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Data Structures for Statistical Computing in Python
McKinney, W. (2010) · Proceedings of the Python in Science Conferences · doi:10.25080/majora-92bf1922-00a · Cited by 12,930 · cited 1×
“These statistical features are computed using the Python pandas [32] library.”
MethodAPI design for machine learning software: experiences from the scikit-learn projectPreprint
Buitinck, L., Louppe, G., Blondel, M., Pedregosa, F., Mueller, A., Grisel, O., Niculae, V., Prettenhofer, P., Gramfort, A., Grobler, J., et al. (2013) · arXiv (Cornell University) · doi:10.48550/arxiv.1309.0238 · Cited by 2,387 · cited 1×
“We leveraged the scikit-learn [34] machine learning libraries to implement the classifiers in our framework.”
MethodA survey of techniques for internet traffic classification using machine learning
Nguyen, T. T. T., & Armitage, G. (2008) · IEEE Communications Surveys & Tutorials · doi:10.1109/surv.2008.080406 · Cited by 1,664 · cited 1×
“Network traffic fingerprinting is not a new area of research, and indeed the literature exemplifies techniques for network traffic classification on traditional computers [7].”
BackgroundDynodroid: an input generation system for Android apps
Machiry, A., Tahiliani, R., & Naik, M. (2013) · ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) · doi:10.1145/2491411.2491450 · Cited by 702
Website Fingerprinting at Internet Scale
Panchenko, A., Lanze, F., Zinnen, A., Henze, M., Pennekamp, J., Wehrle, K., & Engel, T. (2016) · Proceedings 2016 Network and Distributed System Security Symposium · doi:10.14722/ndss.2016.23477 · Cited by 645 · cited 1×
“[17] present a website fingerprinting attack on Tor that outperforms related”
BackgroundWebsite fingerprinting in onion routing based anonymization networks
Panchenko, A., Niessen, L., Zinnen, A., & Engel, T. (2011) · ACM Workshop on Privacy in the Electronic Society (WPES) · doi:10.1145/2046556.2046570 · Cited by 531 · cited 1×
“Similar work was proposed by Panchenko et al. [18].”
MethodPeek-a-Boo, I Still See You: Why Efficient Traffic Analysis Countermeasures Fail
Dyer, K. P., Coull, S. E., Ristenpart, T., & Shrimpton, T. (2012) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2012.28 · Cited by 478 · cited 3×
“[16] presented web-page fingerprinting attacks and discussed their effectiveness despite traffic analysis countermeasures (e.”
BackgroundMethodInfluentialA first look at traffic on smartphones
Falaki, H., Lymberopoulos, D., Mahajan, R., Kandula, S., & Estrin, D. (2010) · ACM/SIGCOMM Internet Measurement Conference · doi:10.1145/1879141.1879176 · Cited by 453
Herrmann, D., Wendolsky, R., & Federrath, H. (2009) · doi:10.1145/1655008.1655013 · Cited by 423 · cited 1×
“Subsequently, Herman et al. [17] outperformed Liberatore et al. by presenting a method that relies on common text mining techniques to the normalized frequency distribution of observable IP packet sizes.”
MethodTraffic Analysis: Protocols, Attacks, Design Issues, and Open Problems
Raymond, J.-F. (2001) · Lecture notes in computer science · doi:10.1007/3-540-44702-4_2 · Cited by 422 · cited 1×
“With the advent of CDNs and standard web service APIs, more apps are sending their traffic to similar endpoints, and this frustrates attempts to fingerprint app traffic based on destination IP address only.”
Background
Research works printed but not linked: 5
- software, 2014, Network Log
- bacic, 2015, Are You Using A Content Delivery Network For Your Website Yet? You Should Be
- muehlstein, 2016, Analyzing HTTPS encrypted traffic to identify user operating system browser and application
- miller, 2014, I Know Why You Went to the Clinic Risks and Realization of HTTPS Traffic Analysis, 143
- stöber, 2013, Who do you sync you are?: Smartphone fingerprinting via application behaviour, Proc 6th ACM Conf Secur Privacy Wirel Mobile Netw (WiSec), 7
Cited by
Sorted by citations
Deep Learning for Encrypted Traffic Classification: An Overview
Rezaei, S., & Liu, X. (2019) · IEEE Communications Magazine · doi:10.1109/mcom.2019.1800819 · Cited by 670
“Note that some studies divide the entire flow into several bursts and then classify each burst to detect different user actions [5].”
BackgroundLin, X., Xiong, G., Gou, G., Li, Z., Shi, J., & Yu, J. (2022) · Proceedings of the ACM Web Conference 2022 · doi:10.1145/3485447.3512217 · Cited by 599
“To this end, some works [27, 36] extract the statistical feature and employ classical machine learning algorithms to handle the encrypted traffic without plaintext (Figure 1(b)).”
BackgroundMethodInfluentialFS-Net: A Flow Sequence Network For Encrypted Traffic Classification
Liu, C., He, L., Xiong, G., Cao, Z., & Li, Z. (2019) · IEEE INFOCOM 2019 - IEEE Conference on Computer Communications · doi:10.1109/infocom.2019.8737507 · Cited by 630
“The general procedures include feature engineering and model training [5]–[8], [13].”
BackgroundMethodAceto, G., Ciuonzo, D., Montieri, A., & Pescapè, A. (2019) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2019.2899085 · Cited by 525
“Based on a dataset of real users’ activity (as opposed to [10], [13], [29], and [30], employing bot-generated mobile traffic), combination results present a performance gain according to all considered metrics.”
BackgroundMethodInfluentialMIMETIC: Mobile encrypted traffic classification using multimodal deep learning
Aceto, G., Ciuonzo, D., Montieri, A., & Pescapè, A. (2019) · Computer Networks · doi:10.1016/j.comnet.2019.106944 · Cited by 291
“cation and complexity standpoints) of MIMETIC approach and methodically compares it to existing (single-modality) DL alternatives [11, 13], approaches to fuse their information [21], and ML-based state-of-the-art in mobile TC [7].”
BackgroundMethodInfluentialA Survey on Encrypted Network Traffic Analysis Applications, Techniques, and Countermeasures
Papadogiannaki, E., & Ioannidis, S. (2021) · ACM Computing Surveys · doi:10.1145/3457904 · Cited by 316
“[147] Classification with Multi-Class Support Vector Machine (SVM), Multi-Class RF, Binary SVM, and Binary RF Precision, Recall, F1-score, Accuracy”
BackgroundMethodInfluentialFlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic
van Ede, T., Bortolameotti, R., Continella, A., Ren, J., Dubois, D. J., Lindorfer, M., Choffnes, D., van Steen, M., & Peter, A. (2020) · Proceedings 2020 Network and Distributed System Security Symposium · doi:10.14722/ndss.2020.24412 · Cited by 339
“Here, we compare our approach against AppScanner [62], a supervised state-of-theart technique to recognize apps in network traffic.”
BackgroundResultInfluentialMachine Learning-Powered Encrypted Network Traffic Analysis: A Comprehensive Survey
Shen, M., Ye, K., Liu, X., Zhu, L., Kang, J., Yu, S., Li, Q. L., & Xu, K. (2022) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2022.3208196 · Cited by 306
“[128] utilize a total of 54 statistical features to construct burst vectors, e.”
When Machine Learning Meets Privacy in 6G: A Survey
Sun, Y., Liu, J., Wang, J., Cao, Y., & Kato, N. (2020) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2020.3011561 · Cited by 211
“build a system which can feasibly identify smartphone Apps by fingerprinting their network traffic [149].”
BackgroundNetwork Intrusion Detection: Based on Deep Hierarchical Network and Original Flow Data
Zhang, Y., Chen, X., Jin, L., Wang, X., & Guo, D. (2019) · IEEE Access · doi:10.1109/access.2019.2905041 · Cited by 219
“(2) split: We use the SplitCap tool to split traffic packets with the same five-tupple information into a flow [25].”
MethodDISTILLER: Encrypted traffic classification via multimodal multitask deep learning
Aceto, G., Ciuonzo, D., Montieri, A., & Pescapè, A. (2021) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2021.102985 · Cited by 185
“For the sake of completeness, we touch upon other meaningful TC objects, however, adopted in the context of non-multitask encrypted TC such as the IP packet [16], HTTP session [27], and service burst [8].”
BackgroundMethodInfluentialMulti-classification approaches for classifying mobile app traffic
Aceto, G., Ciuonzo, D., Montieri, A., & Pescapè, A. (2017) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2017.11.007 · Cited by 184
Fine-Grained Webpage Fingerprinting Using Only Packet Length Information of Encrypted Traffic
Shen, M., Liu, Y., Zhu, L., Du, X., & Hu, J. (2020) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2020.3046876 · Cited by 154
“Motivated by [34], we calculate 18 statistical features (a total of 54 features) for each series: minimum (min), maximum (max), mean (mean), median absolute deviation (mad), standard deviation (std), variance (var ), skew (skew), kurtosis (kurt), percentiles (from 10% to 90%) ( per1-per9) and the number of elements (l…”
BackgroundMethodInfluentialToward effective mobile encrypted traffic classification through deep learning
Aceto, G., Ciuonzo, D., Montieri, A., & Pescapè, A. (2020) · Neurocomputing · doi:10.1016/j.neucom.2020.05.036 · Cited by 147
“Indeed, tuning γ enables a fine-grained control of the classifiers and further (useful) flexibility to mobile TC [11].”
BackgroundMethodInfluentialSmartphone App Usage Analysis: Datasets, Methods, and Applications
Li, T., Xia, T., Wang, H., Tu, Z., Tarkoma, S., Han, Z., & Hui, P. (2022) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2022.3163176 · Cited by 145
A Novel Multimodal Deep Learning Framework for Encrypted Traffic Classification
Lin, P., Ye, K., Hu, Y., Lin, Y., & Xu, C. (2022) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2022.3215507 · Cited by 136
“Appscanner is introduced in [20] and [21], which uses packet length vector to classify mobile applications.”
BackgroundA review on machine learning–based approaches for Internet traffic classification
Salman, O., Elhajj, I. H., Kayssi, A., & Chehab, A. (2020) · Annals of Telecommunications · doi:10.1007/s12243-020-00770-7 · Cited by 136
Sadeghzadeh, A. M., Shiravi, S., & Jalili, R. (2021) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2021.3052888 · Cited by 134
“After several studies in the domain of mobile application identification [26], [27], Aceto et al.”
BackgroundResultA Comprehensive Survey of Recent Internet Measurement Techniques for Cyber Security
Pour, M. S., Nader, C., Friday, K., & Bou‐Harb, E. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103123 · Cited by 147
MaMPF: Encrypted Traffic Classification Based on Multi-Attribute Markov Probability Fingerprints
Liu, C., Cao, Z., Xiong, G., Gou, G., Yiu, S., & He, L. (2018) · International Workshop on Quality of Service · doi:10.1109/iwqos.2018.8624124 · Cited by 122
Large-Scale Mobile App Identification Using Deep Learning
Rezaei, S., Kroencke, B., & Liu, X. (2019) · IEEE Access · doi:10.1109/access.2019.2962018 · Cited by 116
“Identifying ambiguous traffic (i.e. labeling them as ambiguous ) is shown to be possible [5].”
BackgroundMethodResultInfluentialSeeing Traffic Paths: Encrypted Traffic Classification With Path Signature Features
Xu, S., Geng, G., Jin, X., Liu, D., & Weng, J. (2022) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2022.3179955 · Cited by 111
App-Net: A Hybrid Neural Network for Encrypted Mobile Traffic Classification
Wang, X., Chen, S., & Su, J. (2020) · IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS) · doi:10.1109/infocomwkshps50562.2020.9162891 · Cited by 113
“Multiple conventional ML classifiers have been proven successful in encrypted mobile traffic classification (EMTC) [2]–[4].”
BackgroundOptimizing Feature Selection for Efficient Encrypted Traffic Classification: A Systematic Approach
Shen, M., Liu, Y., Zhu, L., Xu, K., Du, X., & Guizani, N. (2020) · IEEE Network · doi:10.1109/mnet.011.1900366 · Cited by 109
“Note that while some existing traffic analysis schemes [8] also considered evaluating feature contribution, there are several obvious differences between the proposed method in this article and the existing methods.”
BackgroundMethodInfluentialNetmamba: Efficient Network Traffic Classification Via Pre-Training Unidirectional Mamba
Wang, T., Xie, X., Wang, W., Wang, C., Zhao, Y., & Cui, Y. (2024) · IEEE International Conference on Network Protocols (ICNP) · doi:10.1109/icnp61940.2024.10858569 · Cited by 115
TrafficFormer: An Efficient Pre-trained Model for Traffic Data
Zhou, G., Guo, X., Liu, Z., Li, T., Li, Q., & Xu, K. (2025) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp61157.2025.00102 · Cited by 104
“Machine learning-based methods [36], [37], [38], [39], [40] rely on expert-designed statistical features of traffic, which are fed into models for training.”
InfluentialThe Dark Side(-Channel) of Mobile Devices: A Survey on Network Traffic Analysis
Conti, M., Li, Q.-Q., Maragno, A., & Spolaor, R. (2017) · IEEE Communications Surveys and Tutorials · doi:10.1109/comst.2018.2843533 · Cited by 97
Self-citationMIRAGE: Mobile-app Traffic Capture and Ground-truth Creation
Aceto, G., Ciuonzo, D., Montieri, A., Persico, V., & Pescapè, A. (2019) · International Conference on Computing, Communication and Security (ICCCS) · doi:10.1109/cccs.2019.8888137 · Cited by 93
“Previous works in the field of traffic classification via machine learning successfully leveraged these features to feed the classification algorithms they devised [16, 21–23].”
BackgroundCharacterization and Prediction of Mobile-App Traffic Using Markov Modeling
Aceto, G., Bovenzi, G., Ciuonzo, D., Montieri, A., Persico, V., & Pescapè, A. (2021) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2021.3051381 · Cited by 83
“traffic, which evolves at fast pace [9], [10].”
BackgroundA Dive into the Dark Web: Hierarchical Traffic Classification of Anonymity Tools
Montieri, A., Ciuonzo, D., Bovenzi, G., Persico, V., & Pescapè, A. (2019) · IEEE Transactions on Network Science and Engineering · doi:10.1109/tnse.2019.2901994 · Cited by 82
“This design choice—already introduced and justified in the mobile context in a flat scenario [28]—here avoids that misclassifications are propagated downwards, at the expense of coarsergrained predictions.”
BackgroundEBSNN: Extended Byte Segment Neural Network for Network Traffic Classification
Xiao, X., Xiao, W., Li, R., Luo, X., Zheng, H.-T., & Xia, S. (2021) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2021.3101311 · Cited by 87
“Besides, Taylor et al. implemented an application classifi-cation framework [13], which exploits statistical features of the packet length sequence, to fingerprint smartphone applications.”
BackgroundHEDGE: Efficient Traffic Classification of Encrypted and Compressed Packets
Casino, F., Choo, K.-K. R., & Patsakis, C. (2019) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2019.2911156 · Cited by 73
“By analysing the features and characteristics of traffic flows, including encrypted traffic flows, one may be able to identify specific user behaviours [7, 48].”
BackgroundATVITSC: A Novel Encrypted Traffic Classification Method Based on Deep Learning
Liu, Y., Wang, X., Qu, B., & Zhao, F. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3433446 · Cited by 79
EC-GCN: A encrypted traffic classification framework based on multi-scale graph convolution networks
Diao, Z.-L., Xie, G.-G., Wang, X., Ren, R., Meng, X.-Y., Zhang, G.-X., Xie, K., & Qiao, M. (2023) · Comput. Networks · doi:10.1016/j.comnet.2023.109614 · Cited by 70
Rago, A., Piro, G., Boggia, G., & Dini, P. (2020) · IEEE Transactions on Vehicular Technology · doi:10.1109/tvt.2020.3005724 · Cited by 68
“of encrypted communication flows [40]–[43].”
Real Network Traffic Collection and Deep Learning for Mobile App Identification
Wang, X., Chen, S., & Su, J. (2020) · Wireless Communications and Mobile Computing · doi:10.1155/2020/4707909 · Cited by 70
“*is method is proposed in [4, 5], which represents the state-of-the-art mobile traffic classifier using traditional machine learning techniques.”
BackgroundMethodInfluentialDeep learning for encrypted traffic classification in the face of data drift: An empirical study
Malekghaini, N., Akbari, E., Salahuddin, M. A., Limam, N., Boutaba, R., Mathieu, B., Moteau, S., & Tuffin, S. (2023) · Computer Networks · doi:10.1016/j.comnet.2023.109648 · Cited by 73
“Although the work in [30] is based on traditional ML models, it relates to our work in the recognition of the effect of ambiguous flows in confounding the classifier, as well as confirming the phenomenon of model decay in mobile app fingerprinting.”
MethodInfluentialPham, T.-D., Ho, T.-L., Truong-Huu, T., Cao, T.-D., & Truong, H. (2021) · Annual Computer Security Applications Conference · doi:10.1145/3485832.3485925 · Cited by 69
“As apps use CDNs or shared services, similar flow characteristics will be observed, thus confusing the classification model [40, 41, 44].”
BackgroundMachine Learning for Traffic Analysis: A Review
Alqudah, N., & Yaseen, Q. M. (2020) · Procedia Computer Science · doi:10.1016/j.procs.2020.03.111 · Cited by 60
BFCN: A Novel Classification Method of Encrypted Traffic Based on BERT and CNN
Shi, Z., Luktarhan, N., Song, Y., & Tian, G. (2023) · Electronics · doi:10.3390/electronics12030516 · Cited by 61
“Port-based N/A Fingerprint construction Deep Packet Inspection (DPI) [9], FlowPrint [6] Statistical methods AppScanner [16], BIND [17] Deep learning model DF [18], FS-NET [19], DeepPacket [9], TSCRNN [20] Pretraining models PERT [23], CDB [24], ET-BERT [8]”
MethodAccurate mobile-app fingerprinting using flow-level relationship with graph neural networks
Jiang, M., Li, Z., Fu, P., Cai, W., Cui, M., Xiong, G., & Gou, G. (2022) · Computer Networks · doi:10.1016/j.comnet.2022.109309 · Cited by 60
Procedures, Criteria, and Machine Learning Techniques for Network Traffic Classification: A Survey
Sheikh, M. S., & Peng, Y. (2022) · IEEE Access · doi:10.1109/access.2022.3181135 · Cited by 65
“They also assessed the performance of the present method against other classifiers such as Web traffic [156] and VoIP [157].”
MethodDevice Fingerprinting for Cyber-Physical Systems: A Survey
Kumar, V., & Paul, K. (2023) · ACM Computing Surveys · doi:10.1145/3584944 · Cited by 55
“In [83, 189, 199], the author uses DFP for device identiication, which is unique, strong, and hard to change.”
BackgroundMethodDE-GNN: Dual embedding with graph neural network for fine-grained encrypted traffic classification
Han, X., Xu, G., Zhang, M., Yang, Z., Yu, Z., Huang, W., & Chen, M. (2024) · Computer Networks · doi:10.1016/j.comnet.2024.110372 · Cited by 58
Hang, Z., Lu, Y., Wang, Y., & Xie, Y. (2023) · International Symposium on Research in Attacks, Intrusions and Defenses (RAID) · doi:10.1145/3607199.3607206 · Cited by 63
“Twelve state-of-the-art generic malicious traffic detection methods are utilized as baselines: AppScanner [45], CU-MUL [33], BIND [1], K-fp [14], FlowPrint [47], DF [41], FS-Net [29], GraphDApp [40], TSCRNN [26], Deeppacket [31], PERT [15], and ET-BERT [27].”
BackgroundMethodFine-grained TLS services classification with reject option
Luxemburk, J., & Čejka, T. (2022) · Computer Networks · doi:10.1016/j.comnet.2022.109467 · Cited by 53
“This approach was justified in [23] for the task of identifying mobile apps.”
Traffic Fingerprinting Attacks on Internet of Things Using Machine Learning
Skowron, M., Janicki, A., & Mazurczyk, W. (2020) · IEEE Access · doi:10.1109/access.2020.2969015 · Cited by 52
An Encrypted Traffic Classification Method Combining Graph Convolutional Network and Autoencoder
Sun, B., Yang, W., Yan, M.-Q., Wu, D.-H., Zhu, Y., & Bai, Z. (2020) · IEEE International Performance, Computing, and Communications Conference · doi:10.1109/ipccc50635.2020.9391542 · Cited by 53
“To overcome the problem that rule-based methods cannot handle encrypted traffic, the Machine Learning (ML)-based methods become the mainstream method for encrypted traffic classification [7]–[10], which combine flow-statistics and machine learning algorithms.”
Method$BitCoding$ : Network Traffic Classification Through Encoded Bit Level Signatures
Hubballi, N., & Swarnkar, M. (2018) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2018.2868816 · Cited by 47
“This task of identifying the application to which an aggregate set of packets belong to is known as traffic classification [8], [24].”
BackgroundPath signature-based XAI-enabled network time series classification
Sun, L., Wang, Y., Ren, Y., & Xia, F. (2024) · Science China Information Sciences · doi:10.1007/s11432-023-3978-y · Cited by 46
Exploiting Diversity in Android TLS Implementations for Mobile App Traffic Classification
Sengupta, S., Ganguly, N., De, P., & Chakraborty, S. (2019) · The World Wide Web Conference · doi:10.1145/3308558.3313738 · Cited by 45
“Tool for side-channel attacks: It follows from the previous discussion, therefore, that along with packet-level and traffic meta-data (e.g., direction of traffic) based features [17, 45, 48], bit-sequence based features can also pose threats via side-channel attacks.”
BackgroundKnow your Big Data Trade-offs when Classifying Encrypted Mobile Traffic with Deep Learning
Aceto, G., Ciuonzo, D., Montieri, A., Persico, V., & Pescapè, A. (2019) · Network Traffic Measurement and Analysis Conference (TMA) · doi:10.23919/tma.2019.8784565 · Cited by 45
“domain-expert driven) features, which in TC context usually correspond to statistics extracted from the sequence of packets [7] or exchanged messages [9].”
BackgroundInfluentialPacket-level prediction of mobile-app traffic using multitask Deep Learning
Montieri, A., Bovenzi, G., Aceto, G., Ciuonzo, D., Persico, V., & Pescapè, A. (2021) · Computer Networks · doi:10.1016/j.comnet.2021.108529 · Cited by 45
Packet-Level Open-World App Fingerprinting on Wireless Traffic
Li, J.-F., Wu, S., Zhou, H., Luo, X.-P., Wang, T., Liu, Y., & Ma, X. (2022) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2022.24210 · Cited by 47
Efficient Fine-Grained Website Fingerprinting via Encrypted Traffic Analysis with Deep Learning
Shen, M., Gao, Z., Zhu, L., & Xu, K. (2021) · International Workshop on Quality of Service · doi:10.1109/iwqos52092.2021.9521272 · Cited by 44
“Statistical features such as maximum, minimum, and average length, are also used for fingerprinting [6, 9, 17].”
BackgroundMethodEncrypted Traffic Classification Based on Text Convolution Neural Networks
Song, M., Jing, R., & Li, S. (2019) · International Conference on Computer Science and Network Technology (ICCSNT) · doi:10.1109/iccsnt47585.2019.8962493 · Cited by 42
“[1] The size of the data packet in a stream is used to compose feature vectors, and the minimum, maximum, average, median, absolute deviation, standard deviation, variance, skew, kurtosis, percentile in the feature vector are calculated as statistical features.”
MethodA Two-Phase Approach to Fast and Accurate Classification of Encrypted Traffic
Wang, Y.-P., He, H., Lai, Y., & Liu, A. X. (2023) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2022.3209979 · Cited by 34
“Prior schemes based on flow statistical features [9], [10], [11], [12] generally use the typical summary statistics taken/evaluated from an entire bidirectional flow (e.”
BackgroundReliability for Smart Healthcare: A Network Slicing Perspective
Vergütz, A., Noubir, G., & Nogueira, M. (2020) · IEEE Network · doi:10.1109/mnet.011.1900458 · Cited by 41
“The framework fingerprints network traffic test other fingerprinting approaches to improve the accuracy and implement the network slices”
MethodMalDIST: From Encrypted Traffic Classification to Malware Traffic Detection and Classification
Bader, O., Lichy, A., Hajaj, C., Dubin, R., & Dvir, A. Z. (2022) · IEEE Consumer Communications and Networking Conference · doi:10.1109/ccnc49033.2022.9700625 · Cited by 41
Combating Imbalance in Network Traffic Classification Using GAN Based Oversampling
Guo, Y., Xiong, G., Li, Z., Shi, J., Cui, M., & Gou, G. (2021) · IFIP Networking Conference (IFIP Networking) · doi:10.23919/ifipnetworking52078.2021.9472777 · Cited by 40
“This results in the performance of existing MLbased NTC schemes being greatly degraded when facing realworld imbalanced traffic classification tasks [3], [6], [13]–[16].”
BackgroundGuarino, I., Aceto, G., Ciuonzo, D., Montieri, A., Persico, V., & Pescapè, A. (2022) · Computer Networks · doi:10.1016/j.comnet.2022.109452 · Cited by 40
“Aiolli et al. [34] focus on identifying user activities on smartphone-based Bitcoin wallet apps , leveraging the earlier methodology proposed in [35].”
MethodOnline multimedia traffic classification from the QoS perspective using deep learning
Wu, Z., Dong, Y., Qiu, X., & Jin, J. (2022) · Computer Networks · doi:10.1016/j.comnet.2021.108716 · Cited by 39
Yang, J., Jiang, X., Lei, Y., Liang, W., Ma, Z., & Li, S. (2024) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2024.3383851 · Cited by 38
Automatic Mobile App Identification From Encrypted Traffic With Hybrid Neural Networks
Wang, X., Chen, S., & Su, J. (2020) · IEEE Access · doi:10.1109/access.2020.3029190 · Cited by 39
“Most previously proposed APP-ID solutions report performance with results based on private datasets which are labeled by approaches of unknown reliability [4]–[6], [10]–[12], [20].”
BackgroundInfluentialPractical Traffic Analysis Attacks on Secure Messaging Applications
Bahramali, A., Houmansadr, A., Soltani, R., Goeckel, D., & Towsley, D. (2020) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2020.24347 · Cited by 48
“Side channel attacks Another class of traffic analysis attacks aims at leaking sensitive information from encrypted network traffic of Internet services [6], [10], [13], [19], [33], [77], [82], [95].”
BackgroundSoK: Decoding the Enigma of Encrypted Network Traffic Classifiers
Wickramasinghe, N. C., Shaghaghi, A., Tsudik, G., & Jha, S. K. (2025) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp61157.2025.00165 · Cited by 49
Rethinking Encrypted Traffic Classification: A Multi-Attribute Associated Fingerprint Approach
Chen, Y., Zang, T., Zhang, Y., Zhou, Y. J., & Wang, Y. (2019) · IEEE International Conference on Network Protocols (ICNP) · doi:10.1109/icnp.2019.8888043 · Cited by 36
“In general, we can generate mobile application traces by adopting Monkeyrunner [23] to fuzz the user interface (UI) of the applications [24], [25] or by employing volunteers to manually operate the applications.”
MethodDeep Learning for Encrypted Traffic Classification and Unknown Data Detection
Pathmaperuma, M. H., Rahulamathavan, Y., Dogan, S., & KONDOZ, A. M. (2022) · Sensors · doi:10.3390/s22197643 · Cited by 34
Effective DDoS Mitigation via ML-Driven In-Network Traffic Shaping
Zhao, Z., Liu, Z., Chen, H., Zhang, F., Song, Z., & Li, Z. (2024) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2023.3349180 · Cited by 35
“These approachescanbegenerallycategorizedintostatistical-based methods[66],[67],[68],sequence-basedapproaches[32],[69], [70],andothers[18],[71],[72]thatuseDNNstodetecttraffic.”
Saeed, A., & Kolberg, M. (2018) · IEEE Access · doi:10.1109/access.2018.2888813 · Cited by 33
“[38] has suggested the alternative method in which a system is used to identify smartphone applications, which are encrypted through 802.”
MethodA Big Data-Enabled Hierarchical Framework for Traffic Classification
Bovenzi, G., Aceto, G., Ciuonzo, D., Persico, V., & Pescapè, A. (2020) · IEEE Transactions on Network Science and Engineering · doi:10.1109/tnse.2020.3009832 · Cited by 32
“Leveraging Machine Learning (ML) approaches to accomplish this task also fulfills the requirement of preserving privacy by performing the classification solely based on the statistical features of the encrypted traffic, without decrypting its content [3].”
BackgroundIdentification of Encrypted Video Streaming Based on Differential Fingerprints
Wu, H., Yu, Z., Cheng, G., & Guo, S. (2020) · IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS) · doi:10.1109/infocomwkshps50562.2020.9162914 · Cited by 32
“In recent years, for different purposes, there have been many types of researches on encrypted traffic, including the identification of encrypted traffic [8], malicious attacks [9] [10] [11], types of application [12] [13] [14], video service providers [15], and video QoE [16] [17] [18].”
BackgroundIncremental Learning for Mobile Encrypted Traffic Classification
Chen, Y., Zang, T., Zhang, Y., Zhou, Y. J., Ouyang, L., & Yang, P. (2021) · International Conference on Communications · doi:10.1109/icc42927.2021.9500619 · Cited by 33
“first design the burst and flow statistical features and propose an encryption-agnostic framework AppScanner to fingerprint mobile applications [4].”
BackgroundGCN-ETA: High-Efficiency Encrypted Malicious Traffic Detection
Zheng, J., Zeng, Z., & Feng, T. (2022) · Security and Communication Networks · doi:10.1155/2022/4274139 · Cited by 32
Identifying WeChat Red Packets and Fund Transfers Via Analyzing Encrypted Network Traffic
Yan, F., Xu, M., Qiao, T., Wu, T., Yang, X. S., Zheng, N., & Choo, K. R. (2018) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom/bigdatase.2018.00198 · Cited by 30
“It practice, 95% of packets on smartphones are received or transmitted within one second (time span) of the previous packet in most current network environment (see [21] for instance).”
BackgroundTransparent and Service-Agnostic Monitoring of Encrypted Web Traffic
Brissaud, P.-O., François, J., Chrisment, I., Cholez, T., & Bettan, O. (2019) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2019.2933155 · Cited by 29
“[19] can profile 110 mobile applications with an accuracy between 73% and 96%.”
BackgroundTrojanFlow: A Neural Backdoor Attack to Deep Learning-based Network Traffic Classifiers
Ning, R., Xin, C., & Wu, H. (2022) · IEEE Conference on Computer Communications (INFOCOM) · doi:10.1109/infocom48880.2022.9796878 · Cited by 29
“To tackle this problem, a few efforts have been made in the research community to identify encrypted network traffic using machine learning (ML) techniques [11]–[13], where ML”
BackgroundAiolli, F., Conti, M., Gangwal, A., & Polato, M. (2019) · ACM Symposium on Applied Computing · doi:10.1145/3297280.3297430 · Cited by 31
“Taylor et al. [27] showed that a passive eavesdropper can recognize Android apps by fingerprinting network traffic.”
BackgroundSelf-citationTSFN: A Novel Malicious Traffic Classification Method Using BERT and LSTM
Shi, Z., Luktarhan, N., Song, Y., & Yin, H. (2023) · Entropy · doi:10.3390/e25050821 · Cited by 28
“Fingerprint construction approach FlowPrint [7] Statistical feature approached AppScanner [12], CUMUL [29], BIND [13], k-fingerprinting (K-fp) [30] Deep learning approaches Deep Fingerprinting (DF) [14], FS-Net [15], GraphDApp [31], TSCRNN [17], Deeppacket [16], wang [5] pre-training approaches PERT…”
Unmasking the Internet: A Survey of Fine-Grained Network Traffic Analysis
Feng, Y., Li, J., Mirković, J., Wu, C., Wang, C., Ren, H., Xu, J., & Liu, Y. (2025) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2025.3545541 · Cited by 37
Android Spyware Detection Using Machine Learning: A Novel Dataset
Qabalin, M. K., Naser, M., & Alkasassbeh, M. S. (2022) · Sensors · doi:10.3390/s22155765 · Cited by 28
“[29] Generic dataset Network traffic-based Machine learning-based”
Lin, X., He, L., Gou, G., Yu, J., Guan, Z., Li, X., Guo, J., & Xiong, G. (2024) · Computers & Security · doi:10.1016/j.cose.2024.103892 · Cited by 27
USB powered devices: A survey of side-channel threats and countermeasures
Liu, H., Spolaor, R., Turrin, F., Bonafede, R., & Conti, M. (2021) · High-Confidence Computing · doi:10.1016/j.hcc.2021.100007 · Cited by 27
Self-citationPacket Representation Learning for Traffic Classification
Meng, X., Wang, Y., Ma, R., Luo, H., Li, X., & Zhang, Y. (2022) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3534678.3539085 · Cited by 26
“• APPS [21]: This method learns to select representative features, and utilize them with a random tree classi er for application classi cation.”
MethodOTTer: A Scalable High-Resolution Encrypted Traffic Identification Engine
Papadogiannaki, E., Halevidis, C., Akritidis, P., & Koromilas, L. (2018) · Lecture notes in computer science · doi:10.1007/978-3-030-00470-5_15 · Cited by 26
BitProb: Probabilistic Bit Signatures for Accurate Application Identification
Hubballi, N., Swarnkar, M., & Conti, M. (2020) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2020.2999856 · Cited by 26
“NETWORK traffic classification [1], [2] is a technique that identifies the application or protocol by inspecting network packets.”
MethodSelf-citationHe, Y. M., He, Q., Fang, S., & Liu, Y. (2021) · International Conference on Mobile Systems, Applications, and Services · doi:10.1145/3458864.3467683 · Cited by 25
“Traffic Analysis: Traffic analysis can achieve various applications, including detecting drones [31, 35], inferring apps [36, 38], monitoring misbehaving apps [42], enforcing network access restrictions [14], identifying actions on apps [11], and detecting hidden wireless cameras [10].”
BackgroundYang, L., Guo, S., Liu, D., Zeng, Y. W., Jiao, X., & Zhou, Y. (2024) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2024.3383218 · Cited by 24
Identifying Known and Unknown Mobile Application Traffic Using a Multilevel Classifier
Zhao, S., Chen, S., Sun, Y., Cai, Z., & Su, J. (2019) · Security and Communication Networks · doi:10.1155/2019/9595081 · Cited by 24
Acceleration of Intrusion Detection in Encrypted Network Traffic Using Heterogeneous Hardware
Papadogiannaki, E., & Ioannidis, S. (2021) · Sensors · doi:10.3390/s21041140 · Cited by 24
“…we believe that typical string pattern matching for packet payload content inspection should be integrated with our proposed packet metadata matching for more mature and effective intrusion detection systems, even if techniques like encryption and traffic analysis resistance can circumvent them.”
BackgroundA Large-Scale Mobile Traffic Dataset For Mobile Application Identification
Zhao, S., Chen, S., Wang, F., Wei, Z.-L., Zhong, J., & Liang, J. (2023) · Computer/law journal · doi:10.1093/comjnl/bxad076 · Cited by 27
BOTection: Bot Detection by Building Markov Chain Models of Bots Network Behavior
Alahmadi, B., Mariconti, E., Spolaor, R., Stringhini, G., & Martinović, I. (2020) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3320269.3372202 · Cited by 24
Self-citationTHE ROLE OF SOCIAL MEDIA IN THE PROCESS OF INFORMING THE PUBLIC ABOUT DISASTER RISKS
Cvetković, V. M., Nikolic, A., & Ivanov, A. (2023) · Journal of Liberty and International Affairs Institute for Research and European Studies - Bitola · doi:10.47305/jlia2392121c · Cited by 25
Let model keep evolving: Incremental learning for encrypted traffic classification
Li, X., Xie, J., Song, Q., Sang, Y.-F., Zhang, Y., Li, S.-H., & Zang, T. (2023) · Computers & security · doi:10.1016/j.cose.2023.103624 · Cited by 22
Nearby Threats: Reversing, Analyzing, and Attacking Google's 'Nearby Connections' on Android
Antonioli, D., Tippenhauer, N. O., & Rasmussen, K. (2019) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2019.23367 · Cited by 21
“The attacker then can perform traffic analysis even on encrypted packets [35].”
BackgroundMEMG: Mobile Encrypted Traffic Classification With Markov Chains and Graph Neural Network
Cai, W., Gou, G., Jiang, M., Liu, C., Xiong, G., & Li, Z. (2021) · IEEE International Conference on High Performance Computing and Communications; IEEE International Conference on Smart City; IEEE International Conference on Data Science and Systems (HPCC/SmartCity/DSS) · doi:10.1109/hpcc-dss-smartcity-dependsys53884.2021.00087 · Cited by 21
Luo, P., Chu, J., & Yang, G. (2023) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2023.103519 · Cited by 21
Extreme SDN Framework for IoT and Mobile Applications Flexible Privacy at the Edge
Uddin, M., Nadeem, T., & Nukavarapu, S. K. (2019) · IEEE International Conference on Pervasive Computing and Communications · doi:10.1109/percom.2019.8767413 · Cited by 21
“encrypted overlapping traffic into individual applications and then apply the side-channel attack on each class to fingerprint and identify individual applications [37], [38].”
BackgroundA communication-channel-based method for detecting deeply camouflaged malicious traffic
Fang, Y., Li, K., Zheng, R., Liao, S., & Wang, Y. (2021) · Computer Networks · doi:10.1016/j.comnet.2021.108297 · Cited by 19
Bovenzi, G., Cerasuolo, F., Montieri, A., Nascita, A., Persico, V., & Pescapè, A. (2022) · IEEE Symposium on Computers and Communications (ISCC) · doi:10.1109/iscc55528.2022.9912986 · Cited by 20
“results [9, 12, 25, 27], namely: min, max, mean, standard deviation, variance, mean absolute deviation, skewness, kurtosis, and 10 to 90 percentiles.”
Metadata
- Authors
- Taylor, V. F., Spolaor, R., Conti, M., & Martinovic, I.
- Affiliations
- University of Oxford (GB)
- University of Padua (IT)
- Venue
- IEEE Transactions on Information Forensics and Security
- Published
- 2018-01
- Volume
- 13
- Issue
- 1
- Pages
- 63-78
- ISSN
- 1556-6013 (ISSN-L)
- 1556-6021
- OpenAlex
- W2609737443
- Cited by
- 439
- References
- 30
- Citations by year
- 2026: 47 · 2025: 69 · 2024: 63 · 2023: 55 · 2022: 60 · 2021: 45 · 2020: 41 · 2019: 39 · 2018: 18
- FWCI
- 16.15
- Type
- journal article
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- IEEE Transactions on Information Forensics and Security (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- Padua Research Archive (University of Padova) (submittedVersion, other-oa)
- arXiv (Cornell University)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Physical Sciences › Computer Science › Information Systems › Digital and Cyber Forensics
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Keywords
- encrypted traffic analysis, packet size, SSL/TLS, passive eavesdropping, privacy leakage
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
