The DOI matches its Crossref record, with a small difference in title or year; 30 of the 30 references it cites were found in a registry or an index.
Robust Smartphone App Identification via Encrypted Network Traffic Analysis
Open accessAbstract
The apps installed on a smartphone can reveal much information about a user, such as their medical conditions, sexual orientation, or religious beliefs. In addition, the presence or absence of particular apps on a smartphone can inform an adversary, who is intent on attacking the device. In this paper, we show that a passive eavesdropper can feasibly identify smartphone apps by fingerprinting the network traffic that they send. Although SSL/TLS hides the payload of packets, side-channel data, such as packet size and direction is still leaked from encrypted connections. We use machine learning techniques to identify smartphone apps from this side-channel data. In addition to merely fingerprinting and identifying smartphone apps, we investigate how app fingerprints change over time, across devices, and across different versions of apps. In addition, we introduce strategies that enable our app classification system to identify and mitigate the effect of ambiguous traffic, i.e., traffic in common among apps, such as advertisement traffic. We fully implemented a framework to fingerprint apps and ran a thorough set of experiments to assess its performance. We fingerprinted 110 of the most popular apps in the Google Play Store and were able to identify them six months later with up to 96% accuracy. Additionally, we show that app fingerprints persist to varying extents across devices and app versions.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“These methods highly rely on expert-designed features and have limited generalization ability.”
From ET-BERT: A Contextualized Datagram Representation with Pre-training Transformers for Encrypted Traffic Classification (2022) · cites this paper as [36]
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Data Structures for Statistical Computing in Python
McKinney, W. (2010) · Proceedings of the Python in Science Conferences · doi:10.25080/majora-92bf1922-00a · Cited by 12,930 · cited 1×
“These statistical features are computed using the Python pandas [32] library.”
MethodAPI design for machine learning software: experiences from the scikit-learn projectPreprint
Buitinck, L., Louppe, G., Blondel, M., Pedregosa, F., Mueller, A., Grisel, O., Niculae, V., Prettenhofer, P., Gramfort, A., Grobler, J., et al. (2013) · arXiv (Cornell University) · doi:10.48550/arxiv.1309.0238 · Cited by 2,387 · cited 1×
“We leveraged the scikit-learn [34] machine learning libraries to implement the classifiers in our framework.”
MethodA survey of techniques for internet traffic classification using machine learning
Nguyen, T. T. T., & Armitage, G. (2008) · IEEE Communications Surveys & Tutorials · doi:10.1109/surv.2008.080406 · Cited by 1,664 · cited 1×
“Network traffic fingerprinting is not a new area of research, and indeed the literature exemplifies techniques for network traffic classification on traditional computers [7].”
BackgroundDynodroid: an input generation system for Android apps
Machiry, A., Tahiliani, R., & Naik, M. (2013) · ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) · doi:10.1145/2491411.2491450 · Cited by 702
Website Fingerprinting at Internet Scale
Panchenko, A., Lanze, F., Zinnen, A., Henze, M., Pennekamp, J., Wehrle, K., & Engel, T. (2016) · Proceedings 2016 Network and Distributed System Security Symposium · doi:10.14722/ndss.2016.23477 · Cited by 645 · cited 1×
“[17] present a website fingerprinting attack on Tor that outperforms related”
BackgroundWebsite fingerprinting in onion routing based anonymization networks
Panchenko, A., Niessen, L., Zinnen, A., & Engel, T. (2011) · ACM Workshop on Privacy in the Electronic Society (WPES) · doi:10.1145/2046556.2046570 · Cited by 531 · cited 1×
“Similar work was proposed by Panchenko et al. [18].”
MethodPeek-a-Boo, I Still See You: Why Efficient Traffic Analysis Countermeasures Fail
Dyer, K. P., Coull, S. E., Ristenpart, T., & Shrimpton, T. (2012) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2012.28 · Cited by 478 · cited 3×
“[16] presented web-page fingerprinting attacks and discussed their effectiveness despite traffic analysis countermeasures (e.”
BackgroundMethodInfluentialA first look at traffic on smartphones
Falaki, H., Lymberopoulos, D., Mahajan, R., Kandula, S., & Estrin, D. (2010) · ACM/SIGCOMM Internet Measurement Conference · doi:10.1145/1879141.1879176 · Cited by 453
Herrmann, D., Wendolsky, R., & Federrath, H. (2009) · doi:10.1145/1655008.1655013 · Cited by 423 · cited 1×
“Subsequently, Herman et al. [17] outperformed Liberatore et al. by presenting a method that relies on common text mining techniques to the normalized frequency distribution of observable IP packet sizes.”
MethodTraffic Analysis: Protocols, Attacks, Design Issues, and Open Problems
Raymond, J.-F. (2001) · Lecture notes in computer science · doi:10.1007/3-540-44702-4_2 · Cited by 422 · cited 1×
“With the advent of CDNs and standard web service APIs, more apps are sending their traffic to similar endpoints, and this frustrates attempts to fingerprint app traffic based on destination IP address only.”
Background
Research works printed but not linked: 5
- software, 2014, Network Log
- bacic, 2015, Are You Using A Content Delivery Network For Your Website Yet? You Should Be
- muehlstein, 2016, Analyzing HTTPS encrypted traffic to identify user operating system browser and application
- miller, 2014, I Know Why You Went to the Clinic Risks and Realization of HTTPS Traffic Analysis, 143
- stöber, 2013, Who do you sync you are?: Smartphone fingerprinting via application behaviour, Proc 6th ACM Conf Secur Privacy Wirel Mobile Netw (WiSec), 7
Cited by
Sorted by citations
Items 101–200 of 439
Yang, X., Ruan, S., Yue, Y.-L., & Sun, B. (2024) · Comput. Networks · doi:10.1016/j.comnet.2023.110120 · Cited by 18
MPAF: Encrypted Traffic Classification With Multi-Phase Attribute Fingerprint
Chen, Y.-G., & Wang, Y.-P. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3428839 · Cited by 15
A novel approach for application classification with encrypted traffic using BERT and packet headers
Yu, J., Choi, Y., Koo, K., & Moon, D. (2024) · Computer Networks · doi:10.1016/j.comnet.2024.110747 · Cited by 23
Fast and Accurate Multi-Task Learning for Encrypted Network Traffic Classification
Park, J.-T., Shin, C.-Y., Baek, U.-J., & Kim, M. (2024) · Applied Sciences · doi:10.3390/app14073073 · Cited by 22
“…BIND [45] (2) ML-and DL-based methodologies: Deep Fingerprinting (DF) [46], FS-Net [15], (1) Statistical feature-based methodologies: AppScanner [54], CUMUL [44], BIND [45] (2) ML-and DL-based methodologies: Deep Fingerprinting (DF) [46], FS-Net [15], Graph-DApp GraphDApp [38], TSCRNN [17],…”
AN-Net: an Anti-Noise Network for Anonymous Traffic Classification
Deng, X., Wang, Y., & Xue, Z. (2024) · International World Wide Web Conference (WWW) · doi:10.1145/3589334.3645691 · Cited by 22
“[1, 4, 12, 27, 37].”
BackgroundMethodInfluentialHierarchical Identifier: Application to User Privacy Eavesdropping on Mobile Payment App
Wang, Y., Zheng, N., Xu, M., Qiao, T., Zhang, Q., Yan, F., & Xu, J. (2019) · Sensors · doi:10.3390/s19143052 · Cited by 19
“Besides, an extended work [12] provided a robustness analysis for Appscanner with mutative configurations.”
BackgroundLin, X., Xiong, G., Gou, G., Dong, W., Yu, J., Li, Z., & Xia, W. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3574971 · Cited by 19
“…approaches have been proposed to address the needs of encrypted traffic analysis, including: ( i ) Statistical feature-based approaches [15], [39] extract statistical features and combine them with classical machine learning algorithms to cope with traffic without plaintext; ( ii ) Raw…”
InfluentialSpatial-Temporal Feature with Dual-Attention Mechanism for Encrypted Malicious Traffic Detection
Liu, J., Wang, L., Hu, W., Gao, Y., Cao, Y., Lin, B., & Zhang, R. (2023) · Security and Communication Networks · doi:10.1155/2023/7117863 · Cited by 20
“Vincent [5] exploited statistical features of packet size for training random forest classifers.”
BackgroundActiveTracker: Uncovering the Trajectory of App Activities over Encrypted Internet Traffic Streams
Li, D., Li, W., Wang, X., Nguyen, C.-T., & Lu, S. (2019) · IEEE International Conference on Sensing, Communication, and Networking (SECON) · doi:10.1109/sahcn.2019.8824928 · Cited by 18
“To solve the problem of identifying app in encrypted traffic streams, [14][28][29] adopts machine learning techniques, and”
BackgroundApp trajectory recognition over encrypted internet traffic based on deep neural network
Li, D., Li, W., Wang, X., Nguyen, C.-T., & Lu, S.-L. (2020) · Comput. Networks · doi:10.1016/j.comnet.2020.107372 · Cited by 15
ditto: WAN Traffic Obfuscation at Line Rate
Meier, R., Lenders, V., & Vanbever, L. (2022) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2022.24056 · Cited by 17
“…known from Internet traffic, where past work shows that it is possible to infer the contents of VoIP calls [31], [46], streamed movies [50], [88]; visited websites [37], [61], [81], [91], [101], or the device identities [22], [24], [78], [83], [87], [93] without having to break the encryption.”
BackgroundAttribute-Based Zero-Shot Learning for Encrypted Traffic Classification
Hu, Y., Cheng, G., Chen, W., & Jiang, B. (2022) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2022.3183247 · Cited by 18
“Early works extracted statistical features (like extremum, mean, deviation) of PLT and IAT as the input of machine learning models for classifying traffic of different protocols, services and applications [1]–[3].”
BackgroundMethodIntrusion Detection Framework for Invasive FPV Drones Using Video Streaming Characteristics
Alsoliman, A., Rigoni, G., Callegaro, D., Levorato, M., Pinotti, C. M., & Conti, M. (2023) · ACM Transactions on Cyber-Physical Systems · doi:10.1145/3579999 · Cited by 17
“Literature generally treats the traic proiling of a device connected to an encrypted network, by leveraging the packet sizes and their inter-arrivals [13, 29] (i.”
BackgroundSelf-citationMalicious Traffic Identification with Self-Supervised Contrastive Learning
Yang, J., Jiang, X., Liang, G., Li, S., & Ma, Z. (2023) · Sensors · doi:10.3390/s23167215 · Cited by 17
“[18] proposed a method called AppScanner, which uses deep learning technology to identify mobile device applications from malicious network traffic.”
MethodFuentes, J. M. D., González‐Manzano, L., & Ribagorda, A. (2018) · Sensors · doi:10.3390/s18041219 · Cited by 17
“Similarly, the amount of transmitted data is intrinsically linked to the usage of applications [21].”
BackgroundThe Untold Secrets of WiFi-Calling Services: Vulnerabilities, Attacks, and Countermeasures
Xie, T., Tu, G.-H., Yin, B., Li, C.-Y., Peng, C., Zhang, M., Liu, H., & Liu, X. (2020) · IEEE Transactions on Mobile Computing · doi:10.1109/tmc.2020.2995509 · Cited by 18
A survey on analyzing encrypted network traffic of mobile devices
Agrawal, A., Bhatia, A., Bahuguna, A., Tiwari, K., Haribabu, K., Vishwakarma, D. K., & Kaushik, R. (2022) · International Journal of Information Security · doi:10.1007/s10207-022-00581-y · Cited by 17
“[95] approach uses side-channel data for identifying mobile applications.”
Empirical Characterization of Network Traffic for Reliable Communication in IoT Devices
Bebortta, S., & Senapati, D. (2021) · Studies in systems, decision and control · doi:10.1007/978-3-030-67361-1_3 · Cited by 16
Wang, Y., Xiong, G., Liu, C., Li, Z., Cui, M., & Gou, G. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-86514-6_32 · Cited by 16
“Traffic classification attracts many researchers and lots of methods have been proposed for website classification [3,14,15,19,20], mobile application classification [6,12,21,22,26] and user behavior classification [4,24], but few efforts have been made on DApps encrypted traffic classification.”
BackgroundNetwork Intrusion Detection in Encrypted Traffic
Papadogiannaki, E., Tsirantonakis, G., & Ioannidis, S. (2022) · IEEE Conference on Dependable and Secure Computing (DSC) · doi:10.1109/dsc54232.2022.9888942 · Cited by 16
“Besides network security, there are systems that focus on the inspection of encrypted network traffic specifically for use-cases of network analytics [11], [16], [49].”
BackgroundAutomated IoT Device Fingerprinting Through Encrypted Stream Classification
Sun, J., Sun, K., & Shenefiel, C. (2019) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-030-37228-6_8 · Cited by 15
“Network traffic analysis has been applied to various applications such as intrusion detection [36] and app identification [34].”
MethodPersonalized Context-aware Collaborative Online Activity Prediction
Fan, Y., Tu, Z., Li, Y., Chen, X., Gao, H., Zhang, L., Su, L., & Jin, D. (2019) · Proceedings of the ACM on Interactive Mobile Wearable and Ubiquitous Technologies · doi:10.1145/3369829 · Cited by 15
“Existing works focus on various dimensions such as user interactions [15, 46], network traffic [27, 52], and energy drain [10, 24].”
BackgroundBarman, L., Dumur, A., Pyrgelis, A., & Hubaux, J. (2021) · Proceedings of the ACM on Interactive Mobile Wearable and Ubiquitous Technologies · doi:10.1145/3463512 · Cited by 15
“However, these attacks are not all equal: The majority of them use network-or transport-layer headers [42, 76] or application layer headers [27, 28, 83, 84] and can use IP-based flow separation to facilitate the attack.”
BackgroundMethodResultInfluentialIdentify What You are Doing: Smartphone Apps Fingerprinting on Cellular Network Traffic
Zhai, L., Qiao, Z., Wang, Z., & Dong, W. (2021) · IEEE Symposium on Computers and Communications (ISCC) · doi:10.1109/iscc53001.2021.9631415 · Cited by 15
Data Drift in DL: Lessons Learned from Encrypted Traffic Classification
Malekghaini, N., Akbari, E., Salahuddin, M. A., Limam, N., Boutaba, R., Mathieu, B., Moteau, S., & Tuffin, S. (2022) · IFIP Networking Conference (IFIP Networking) · doi:10.23919/ifipnetworking55013.2022.9829791 · Cited by 15
“As opposed to the synthetic datasets employed in [18], our work is based on real-world datasets.”
MethodProfit: Detecting and Quantifying Side Channels in Networked Applications
Rosner, N., Kadron, İ. B., Bang, L., & Bultan, T. (2019) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2019.23536 · Cited by 15
“Feature extraction is commonly used in leakage quantification and machine learning to extract information from data [47].”
BackgroundMethodUnveiling traffic paths: Explainable path signature feature-based encrypted traffic classification
Xu, S., Kong, K., Jin, X., & Geng, G. (2024) · Computers & Security · doi:10.1016/j.cose.2024.104283 · Cited by 14
Liu, T., Ma, X., Liu, L., Liu, X., Zhao, Y., Hu, N., & Ghafoor, K. Z. (2024) · Mathematics · doi:10.3390/math12111624 · Cited by 14
Incremental encrypted traffic classification via contrastive prototype networks
Cai, W., Hou, C., Cui, M.-X., Wang, B., Xiong, G., & Gou, G.-P. (2024) · Comput. Networks · doi:10.1016/j.comnet.2024.110591 · Cited by 14
Zhao, X., Bhuiyan, M. Z. A., Qi, L., Nie, H., Tang, W., & Dou, W. (2019) · Journal of Systems Architecture · doi:10.1016/j.sysarc.2019.101665 · Cited by 14
Encrypted 5G Over- The- Top Voice Traffic Identification Based on Deep Learning
Qiao, Z., Zhai, L., Zhang, S., & Zhang, X. (2021) · IEEE Symposium on Computers and Communications (ISCC) · doi:10.1109/iscc53001.2021.9631458 · Cited by 16
LaFFT: Length-Aware FFT Based Fingerprinting for Encrypted Network Traffic Classification
Liu, C., Cao, Z., Li, Z., & Xiong, G. (2018) · IEEE Symposium on Computers and Communications (ISCC) · doi:10.1109/iscc.2018.8538732 · Cited by 14
“Thereinto, the key and urgent task is encrypted traffic analysis, and the first step is the encrypted traffic classification [1].”
BackgroundWang, X., Wang, X., Jin, L., Lv, R., Dai, B., He, M., & Lv, T. (2021) · IEEE Access · doi:10.1109/access.2021.3068267 · Cited by 14
“After artificially extracting the relevant features of the network traffic, researchers use machine learning (ML) algorithms such as support vector machine (SVM) [4], [5] and random forest (RF) [6], [7] to fit traffic data.”
MethodMM4flow: A Pre-trained Multi-modal Model for Versatile Network Traffic Analysis
Yang, L., Liu, L., Huang, J., Liu, Z., Liang, S., Fu, S., & Wang, Y. (2025) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3719027.3744804 · Cited by 15
“Traditional ML-based methods [7–9, 50, 69, 81] heavily rely on expert knowledge to select artificial features.”
InfluentialMulti-Task Scenario Encrypted Traffic Classification and Parameter Analysis
Wang, G., & Gu, Y. (2024) · Sensors · doi:10.3390/s24103078 · Cited by 17
Tan, X.-B., Peng, C., Xie, P., Wang, H., Li, M., Chen, S.-W., & Zou, C. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3441935 · Cited by 9
Countering Machine-Learning Classification of Applications by Equalizing Network Traffic Statistics
Fathi-Kazerooni, S., & Rojas‐Cessa, R. (2021) · IEEE Transactions on Network Science and Engineering · doi:10.1109/tnse.2021.3113656 · Cited by 15
Study of methods for endpoint aware inspection in a next generation firewall
Heino, J., Hakkala, A., & Virtanen, S. (2022) · Cybersecurity · doi:10.1186/s42400-022-00127-8 · Cited by 13
“Nonetheless, the traffic patterns are not very labile as shown in Taylor et al. (2018), where information collected six months prior could still be used with 96% accuracy to identify the mobile application.”
BackgroundEncrypted Traffic Classification Based on Unsupervised Learning in Cellular Radio Access Networks
Gijón, C., Toril, M., Solera-Delgado, M., Luna-Ramírez, S., & Jiménez, L. R. (2020) · IEEE Access · doi:10.1109/access.2020.3022980 · Cited by 13
“In [19], the same framework is used to assess the degradation of classification performance due to changes in app fingerprints.”
BackgroundMethodFacing Unknown: Open-World Encrypted Traffic Classification Based on Contrastive Pre-Training
Li, X., Feng, B., Zang, T., Xu, X., Zhao, S., & Ma, J. (2023) · International Symposium on Computers and Communications · doi:10.1109/iscc58397.2023.10218269 · Cited by 9
“[11] first designed the burst and flow statistical features and offered a robust app classification method.”
MethodPeng, W., Cui, L., Cai, W., Wang, W., Cui, X., Hao, Z., & Yun, X. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3529316 · Cited by 14
On Detecting Route Hijacking Attack in Opportunistic Mobile Networks
Altaweel, A., Radu Stoleru, B., Gu, G., Maity, A. K., & Bhunia, S. (2022) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2022.3186029 · Cited by 12
“bandwidth); b) eavesdropping and traffic analysis attack, which enables Eve to identify the types of network traffic and apps of the legitimate nodes [19], [20] in OMNs; c) incentives”
BackgroundHead(er)Hunter: Fast Intrusion Detection using Packet Metadata Signatures
Papadogiannaki, E., Deyannis, D., & Ioannidis, S. (2020) · IEEE International Workshop on Computer Aided Modeling and Design of Communication Links and Networks (CAMAD) · doi:10.1109/camad50429.2020.9209308 · Cited by 12
“Many other research and commercial solutions focus on inspection of encrypted network traffic mostly for network analytics [31], [3], [32].”
BackgroundCactus: Obfuscating Bidirectional Encrypted TCP Traffic at Client Side
Xie, R., Cao, J., Zhu, Y., Zhang, Y., He, Y., Peng, H., Wang, Y., Xu, M., Sun, K., Dong, E., et al. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3442530 · Cited by 13
“These attacks serve as the foundation for various tasks, including application identification [5], [58], [60], [66], website fingerprinting [21], [28], [48], [51], [53], [54], user profiling [17], [23], operating system identification [30], [57], and IoT device identification [2], [38].”
Conti, M., Rigoni, G., & Toffalini, F. (2020) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1145/3407023.3407076 · Cited by 11
“(1) we extract bursts from the network traffic by grouping packets with a time gap lower than one second (as done in [34]).”
BackgroundMethodInfluentialSelf-citationEncrypted Multitask Traffic Classification via Multimodal Deep Learning
Aceto, G., Ciuonzo, D., Montieri, A., Nascita, A., & Pescapè, A. (2021) · International Conference on Communications · doi:10.1109/icc42927.2021.9500316 · Cited by 11
“necessarily relying on port information [5].”
App identification based on encrypted multi-smartphone sources traffic fingerprints
Ren, Q., Yang, C., & Ma, J. (2021) · Computer Networks · doi:10.1016/j.comnet.2021.108590 · Cited by 12
CNN for User Activity Detection Using Encrypted In-App Mobile Data
Pathmaperuma, M. H., Rahulamathavan, Y., Dogan, S., & KONDOZ, A. M. (2022) · Future Internet · doi:10.3390/fi14020067 · Cited by 11
“[2,10] used features, such as packet lengths and statistical properties of flows, to train support vector classifier (SVCs) and random forest classifiers to perform mobile app classification.”
MethodNovel HTTPS classifier driven by packet bursts, flows, and machine learning
Tropkova, Z., Hynek, K., & Čejka, T. (2021) · International Conference on Network and Service Management (CNSM) · doi:10.23919/cnsm52442.2021.9615561 · Cited by 11
“[13], which defines a burst by the maximal size of interpacket space.”
BackgroundIntrusion Detection for Encrypted Flows Using Single Feature Based on Graph Integration Theory
Han, Y., Wang, X., He, M., Wang, X., & Guo, S. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3360039 · Cited by 10
Bayat, M., Garshasbi, J., Mehdizadeh, M., Nozari, N., Khesal, A. R., Dokhaei, M., & Teimouri, M. (2024) · BMC Research Notes · doi:10.1186/s13104-024-06817-5 · Cited by 12
“This challenge stems from the unpredictable nature of real-world network environments [15, 16] and the dynamic and evolving behavior of mobile apps [13, 17–19].”
BackgroundZou, A., Yang, W., Tang, C.-W., Lu, J., & Guo, J.-Y. (2024) · Computers & electrical engineering · doi:10.1016/j.compeleceng.2024.109406 · Cited by 11
Lightweight Hybrid Device Identification for IoT Applications
Liu, W., Cao, B., Lu, T., Cai, C., Hu, M., Peng, K., & Xiong, Z. (2025) · IEEE Internet of Things Journal · doi:10.1109/jiot.2025.3554008 · Cited by 10
Mobile Traffic Anonymization Through Probabilistic Distribution
Chaddad, L., Chehab, A., Elhajj, I. H., & Kayssi, A. I. (2019) · Conference on Innovation in Clouds, Internet and Networks and Workshops (ICIN) · doi:10.1109/icin.2019.8685871 · Cited by 10
Feedback-driven side-channel analysis for networked applications
Kadron, İ. B., Rosner, N., & Bultan, T. (2020) · ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA) · doi:10.1145/3395363.3397365 · Cited by 10
Multi-granularity Mobile Encrypted Traffic Classification Based on Fusion Features
Zhang, H., Gou, G., Xiong, G., Liu, C., Tan, Y., & Ye, K. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-89137-4_11 · Cited by 10
App traffic mutation: Toward defending against mobile statistical traffic analysis
Chaddad, L., Chehab, A., Elhajj, I. H., & Kayssi, A. (2018) · Conference on Computer Communications Workshops · doi:10.1109/infcomw.2018.8406899 · Cited by 9
“For further evaluation, we conduct an empirical approach to test our thwarting technique on a recent mobile apps classification approach presented in [11, 21].”
MethodTraffic Analysis Attack for Identifying Users’ Online Activities
Kausar, F., Aljumah, S., Alzaydi, S., & Alroba, R. (2019) · IT Professional · doi:10.1109/mitp.2018.2876988 · Cited by 10
“Furthermore, many services utilize cloud, which makes use of load balancers, making it difficult to map backend servers IPs with the service.(6,7) In addition, techniques that rely on ports, deep packet inspection, IP address, and server name indication can be bypassed.”
BackgroundA Real Network Environment Dataset for Traffic Analysis
Jiang, W., Zhang, B., Zhu, Q., Liao, C., & Wang, W. (2025) · Scientific Data · doi:10.1038/s41597-025-04876-2 · Cited by 10
“Deep packet inspection (DPI) and deep flow inspection (DFI) technologies are commonly used in the industry to annotate network traffic data 8,9 .”
FlowBERT: An Encrypted Traffic Classification Model Based on Transformers Using Flow Sequence
Pan, Q., Yu, Y., Yan, H., Wang, M., & Qi, B. (2023) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom60117.2023.00039 · Cited by 9
TrafCL: Robust Encrypted Malicious Traffic Detection via Contrastive Learning
Yang, X., Ruan, S., Li, J.-Y., Yue, Y.-L., & Sun, B. (2024) · International Conference on Information and Knowledge Management · doi:10.1145/3627673.3679839 · Cited by 13
“(2) Statistical methods usually extract features of packet size and time, then classify using machine learning algorithms, e.g., AppScanner [36] and BSRF [44].”
On Reliability of JA3 Hashes for Fingerprinting Mobile Applications
Matoušek, P., Burgetová, I., Ryšavý, O., & Victor, M. (2020) · International ICST Conference on Digital Forensics & Cyber Crime · doi:10.1007/978-3-030-68734-2_1 · Cited by 11
Bi-ETC: A Bidirectional Encrypted Traffic Classification Model Based on BERT and BiLSTM
Ma, X., Liu, T., Hu, N., & Liu, X. (2023) · IEEE International Conference on Data Science in Cyberspace · doi:10.1109/dsc59305.2023.00037 · Cited by 9
“To this end, many scholars use machine learning[6, 7] to assist traffic classification methods, and train classifiers based on manually extracted packet or its statistical features at the data flow level.”
BackgroundMethodPGSM-DPI: Precisely Guided Signature Matching of Deep Packet Inspection for Traffic Analysis
Yan, H., Li, H., Xiao, M., Dai, R., Zheng, X., Zhao, X., & Li, F. (2019) · Globecom · doi:10.1109/globecom38437.2019.9013941 · Cited by 9
“[16].”
APPCLASSIFIER: Automated App Inference on Encrypted Traffic via Meta Data Analysis
Xiang, C., Chen, Q., Xue, M., & Zhu, H. (2018) · Globecom · doi:10.1109/glocom.2018.8647508 · Cited by 9
“Their further work [4] showed different devices, app versions, and time periods will severely decrease inference accuracy since app logic would change through different devices, app versions and time periods.”
BackgroundInfluentialZero-relabelling mobile-app identification over drifted encrypted network traffic
Jiang, M., Cui, M., Liu, C., Gou, G., Xiong, G., & Li, Z. (2023) · Computer Networks · doi:10.1016/j.comnet.2023.109728 · Cited by 10
Survey of IoT multi-protocol gateways: Architectures, protocols and cybersecurity
Abdelwahed, S. H., Hefny, I., Hegazy, M., Said, L. A., & Soltan, A. (2025) · Internet of Things · doi:10.1016/j.iot.2025.101703 · Cited by 8
FingerprinTV: Fingerprinting Smart TV Apps
Varmarken, J., Aaraj, J. A., Trimananda, R., & Markopoulou, A. (2022) · Proceedings on Privacy Enhancing Technologies · doi:10.56553/popets-2022-0088 · Cited by 12
A Robust and Accurate Encrypted Video Traffic Identification Method via Graph Neural Network
Zhao, L., Chen, J., Ma, X., Du, M., Zhang, Z., & Liu, Q. (2023) · International Conference on Computer Supported Cooperative Work in Design (CSCWD) · doi:10.1109/cscwd57460.2023.10152581 · Cited by 8
“[10] extracted 54 features for each stream to construct application fingerprints, and it was demonstrated that these features maintain some stability across versions and devices; Chen et al.”
MethodDetection and utilization of new-type encrypted network traffic in distributed scenarios
Zhang, P., Chen, F., & Yue, H. (2023) · Engineering Applications of Artificial Intelligence · doi:10.1016/j.engappai.2023.107196 · Cited by 8
Mobile app identification for encrypted network flows by traffic correlation
He, G., Xu, B., Zhang, L., & Zhu, H. (2018) · International Journal of Distributed Sensor Networks · doi:10.1177/1550147718817292 · Cited by 8
Edge Computing Based Traffic Analysis System Using Broad Learning
Peng, X., Ota, K., & Dong, M. (2019) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-030-22971-9_20 · Cited by 8
DeepMag+: Sniffing mobile apps in magnetic field through deep learning
Ning, R., Wang, C., Xin, C., Jiang, L., & Wu, H. (2019) · Pervasive and Mobile Computing · doi:10.1016/j.pmcj.2019.101106 · Cited by 8
“Various methods have been leveraged, for instance, power usage [5], system behavior [6], and network traffic [7,8].”
BackgroundMethodNTARC: A Data Model for the Systematic Review of Network Traffic Analysis Research
Iglesias, F., Ferreira, D. C., Vormayr, G., Bachl, M., & Zseby, T. (2020) · Applied Sciences · doi:10.3390/app10124307 · Cited by 8
Shi, J., Liu, M., Hou, C., Jiang, M., & Xiong, G. (2021) · International Conference on Computer and Communication Systems (ICCCS) · doi:10.1109/icccs52626.2021.9449097 · Cited by 8
“The performance might become worse if such a method was deployed in a larger dataset according to literature [4].”
MethodShi, J., Yang, C., Yang, Q., Zhang, J., Cui, M., & Xiong, G. (2021) · IEEE International Conference on Computer and Communication Engineering Technology (CCET) · doi:10.1109/ccet52649.2021.9544168 · Cited by 9
“…the original packet length sequences as the input of the classifier [11], [12] and variant packet length sequence statistics as a fingerprint [9], [13], this kind of fingerprint is suitable for full encryption scenarios, but the flow packet length sequence is often affected by the network…”
BackgroundMethodSSAPPIDENTIFY: A robust system identifies application over Shadowsocks’s traffic
Wang, S., Yang, C., Guo, G., Chen, M., & Ma, J. (2021) · Computer Networks · doi:10.1016/j.comnet.2021.108659 · Cited by 8
Seq2Path: a sequence-to-path-based flow feature fusion approach for encrypted traffic classification
Jiang, C., Xu, S., Geng, G., Weng, J., & Zhang, X. (2022) · Cluster Computing · doi:10.1007/s10586-022-03709-w · Cited by 8
“[12] proposed a method to extract 54 statistical features from the incoming flow, outgoing flow and complete flow.”
BackgroundMethodMobile App Fingerprinting through Automata Learning and Machine Learning
Marzani, F., Ghassemi, F., Sabahi-Kaviani, Z., van Ede, T., & van Steen, M. R. (2023) · IFIP Networking Conference (IFIP Networking) · doi:10.23919/ifipnetworking57963.2023.10186420 · Cited by 10
An Encrypted Traffic Classification Approach Based on Path Signature Features and LSTM
Mei, Y., Luktarhan, N., Zhao, G., & Yang, X. (2024) · Electronics · doi:10.3390/electronics13153060 · Cited by 7
The Analysis of Encrypted Video Stream Based on Low-Dimensional Embedding Method
Yang, L., Fu, S., Wang, Y., Liu, L., & Luo, Y. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3515816 · Cited by 7
Fang, C., Liu, Y., Teng, S., Yin, M., & Han, T. (2025) · Computer Networks · doi:10.1016/j.comnet.2025.111723 · Cited by 7
OSF-EIMTC: An open-source framework for standardized encrypted internet traffic classification
Bader, O., Lichy, A., Dvir, A. Z., Dubin, R., & Hajaj, C. (2023) · Computer Communications · doi:10.1016/j.comcom.2023.10.011 · Cited by 7
Gu, Z., Gou, G., Liu, C., Yang, C., Zhang, X., Li, Z., & Xiong, G. (2024) · Computer Networks · doi:10.1016/j.comnet.2024.110278 · Cited by 8
Mobile Application Encryption Traffic Classification Based On TLS Flow Sequence Network
Wu, H., Wang, L., Cheng, G., & Hu, X. (2021) · IEEE International Conference on Communications workshops · doi:10.1109/iccworkshops50388.2021.9473738 · Cited by 7
“Currently, the emergence of standard web service APIs has become normal, and more and more applications are using standard web service APIs to send their traffic to the same server [6],[10].”
BackgroundMethodInfluentialBozorgi, A., Bahramali, A., Rezaei, F., Ghafari, A., Houmansadr, A., Soltani, R., Goeckel, D., & Towsley, D. (2022) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2022.3218191 · Cited by 8
“Side channel attacks Another class of traffic analysis attacks aims at leaking sensitive information from encrypted network traffic of Internet services [8], [12], [15], [21], [34], [83], [94], [114].”
BackgroundLi, S.-B., Huang, Y., Gao, T., Yang, L., Chen, Y.-G., Pan, Q., Zang, T., & Chen, F. (2023) · Wireless Communications and Mobile Computing · doi:10.1155/2023/9118153 · Cited by 10
DataZoo: Streamlining Traffic Classification Experiments
Luxemburk, J., & Hynek, K. (2023) · doi:10.1145/3630050.3630176 · Cited by 7
“Traffic classification has a lot of sub-tasks, for example, mobile application classification [1, 18, 20], malware detection [4, 22], user behavior identification [11], VPN/tunnel detection [2, 7], or web service classification [3, 8, 19].”
BackgroundCollusiveHijack: A New Route Hijacking Attack and Countermeasures in Opportunistic Networks
Altaweel, A., Radu Stoleru, B., Gu, G., & Maity, A. K. (2019) · IEEE Conference on Communications and Network Security · doi:10.1109/cns.2019.8802699 · Cited by 7
“…b) eavesdropping and traf fi c analysis attack, which enables Eve to identify the types of network traf fi c and apps of the legitimate nodes [11] [12]; c) incentives seeking attack (i.e., if an incentive based mechanism [13] is employed in the OMN, Eve’s nodes can deliver the hijacked…”
BackgroundMahboob, T., Lim, J. W., Shah, S. T., & Chung, M. Y. (2021) · IEEE Systems Journal · doi:10.1109/jsyst.2021.3089175 · Cited by 7
A Method for Identifying eHealth Applications Using Side-Channel Information
Vergütz, A., Medeiros, I., do Rosário, D. L., Cerqueira, E., dos Santos, A. L., & Nogueira, M. (2019) · Globecom · doi:10.1109/globecom38437.2019.9013503 · Cited by 7
“However, most studies in the literature have applied this approach to identify common Internet applications, such as Skype and Facebook [5], mobile applications [11], [6], IoT-specific [7] and others [12].”
BackgroundMethodLevshun, D. S., Chechulin, A. A., & Kotenko, I. V. (2022) · Sensors · doi:10.3390/s22135063 · Cited by 6
Fast Application Activity Recognition with Encrypted Traffic
Liu, X., Zhang, S., Li, H., & Wang, W. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-86130-8_25 · Cited by 6
Lightweight Fingerprint Attack and Encrypted Traffic Analysis on News Articles
Hasselquist, D., Lindblom, M., & Carlsson, N. F. (2022) · IFIP Networking Conference (IFIP Networking) · doi:10.23919/ifipnetworking55013.2022.9829796 · Cited by 7
“Besides identifying browsed web pages, fingerprinting attacks and encrypted traffic analysis can also be used to reveal other information, such as user actions [35], buffer conditions [36], video streams [37], mobile applications [38], voice traffic [39], and messaging applications [40].”
MethodBjörklund, M., Julin, M., Antonsson, P., Stenwreth, A., Åkvist, M., Hjalmarsson, T., & Duvignau, R. (2023) · IEEE Consumer Communications and Networking Conference · doi:10.1109/ccnc51644.2023.10060390 · Cited by 6
“[10], capable of identifying with 99% accuracy 110 popular applications from encrypted network traces after listening to 30min of network traffic.”
BackgroundMethodInfluentialMETC-MVAE: Mobile Encrypted Traffic Classification With Masked Variational Autoencoders
Cai, W., Li, Z., Fu, P., Hou, C., Xiong, G., & Gou, G. (2022) · IEEE International Conference on High Performance Computing and Communications; IEEE International Conference on Smart City; IEEE International Conference on Data Science and Systems (HPCC/SmartCity/DSS) · doi:10.1109/hpcc-dss-smartcity-dependsys57074.2022.00220 · Cited by 6
“feature-based methods include: constructing statistical features of packets/flows [7], constructing statistical features of bursts [11], constructing meta-centric features [21] and constructing sequence features [22].”
BackgroundMethodInfluentialNet-track: Generic Web Tracking Detection Using Packet Metadata
Lee, D., Joo, M., & Lee, W. (2023) · International World Wide Web Conference (WWW) · doi:10.1145/3543507.3583372 · Cited by 6
“, [3, 26, 30]), our work is the frst attempt to apply this methodology in the feld of tracker detection.”
BackgroundMethodSNDMI: Spyware network traffic detection method based on inducement operations
Peng, J., Guo, C., Ping, Y., Cui, Y., Chen, Y., & Shen, G. (2024) · Computers & Security · doi:10.1016/j.cose.2024.103806 · Cited by 6
Smartphone Traffic Analysis: A Contemporary Survey of the State-of-the-Art
Kumar, S., Indu, S., & Walia, G. S. (2020) · Advances in intelligent systems and computing · doi:10.1007/978-981-15-8061-1_26 · Cited by 6
Guo, L., Wang, S., Yin, J., Wang, Y., Yang, J., & Gui, G. (2021) · Physical Communication · doi:10.1016/j.phycom.2021.101438 · Cited by 6
Metadata
- Authors
- Taylor, V. F., Spolaor, R., Conti, M., & Martinovic, I.
- Affiliations
- University of Oxford (GB)
- University of Padua (IT)
- Venue
- IEEE Transactions on Information Forensics and Security
- Published
- 2018-01
- Volume
- 13
- Issue
- 1
- Pages
- 63-78
- ISSN
- 1556-6013 (ISSN-L)
- 1556-6021
- OpenAlex
- W2609737443
- Cited by
- 439
- References
- 30
- Citations by year
- 2026: 47 · 2025: 69 · 2024: 63 · 2023: 55 · 2022: 60 · 2021: 45 · 2020: 41 · 2019: 39 · 2018: 18
- FWCI
- 16.15
- Type
- journal article
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- IEEE Transactions on Information Forensics and Security (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- Padua Research Archive (University of Padova) (submittedVersion, other-oa)
- arXiv (Cornell University)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Physical Sciences › Computer Science › Information Systems › Digital and Cyber Forensics
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Keywords
- encrypted traffic analysis, packet size, SSL/TLS, passive eavesdropping, privacy leakage
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
