The DOI matches its Crossref record, with a small difference in title or year; 30 of the 30 references it cites were found in a registry or an index.
Robust Smartphone App Identification via Encrypted Network Traffic Analysis
Open accessAbstract
The apps installed on a smartphone can reveal much information about a user, such as their medical conditions, sexual orientation, or religious beliefs. In addition, the presence or absence of particular apps on a smartphone can inform an adversary, who is intent on attacking the device. In this paper, we show that a passive eavesdropper can feasibly identify smartphone apps by fingerprinting the network traffic that they send. Although SSL/TLS hides the payload of packets, side-channel data, such as packet size and direction is still leaked from encrypted connections. We use machine learning techniques to identify smartphone apps from this side-channel data. In addition to merely fingerprinting and identifying smartphone apps, we investigate how app fingerprints change over time, across devices, and across different versions of apps. In addition, we introduce strategies that enable our app classification system to identify and mitigate the effect of ambiguous traffic, i.e., traffic in common among apps, such as advertisement traffic. We fully implemented a framework to fingerprint apps and ran a thorough set of experiments to assess its performance. We fingerprinted 110 of the most popular apps in the Google Play Store and were able to identify them six months later with up to 96% accuracy. Additionally, we show that app fingerprints persist to varying extents across devices and app versions.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“These methods highly rely on expert-designed features and have limited generalization ability.”
From ET-BERT: A Contextualized Datagram Representation with Pre-training Transformers for Encrypted Traffic Classification (2022) · cites this paper as [36]
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Data Structures for Statistical Computing in Python
McKinney, W. (2010) · Proceedings of the Python in Science Conferences · doi:10.25080/majora-92bf1922-00a · Cited by 12,930 · cited 1×
“These statistical features are computed using the Python pandas [32] library.”
MethodAPI design for machine learning software: experiences from the scikit-learn projectPreprint
Buitinck, L., Louppe, G., Blondel, M., Pedregosa, F., Mueller, A., Grisel, O., Niculae, V., Prettenhofer, P., Gramfort, A., Grobler, J., et al. (2013) · arXiv (Cornell University) · doi:10.48550/arxiv.1309.0238 · Cited by 2,387 · cited 1×
“We leveraged the scikit-learn [34] machine learning libraries to implement the classifiers in our framework.”
MethodA survey of techniques for internet traffic classification using machine learning
Nguyen, T. T. T., & Armitage, G. (2008) · IEEE Communications Surveys & Tutorials · doi:10.1109/surv.2008.080406 · Cited by 1,664 · cited 1×
“Network traffic fingerprinting is not a new area of research, and indeed the literature exemplifies techniques for network traffic classification on traditional computers [7].”
BackgroundDynodroid: an input generation system for Android apps
Machiry, A., Tahiliani, R., & Naik, M. (2013) · ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) · doi:10.1145/2491411.2491450 · Cited by 702
Website Fingerprinting at Internet Scale
Panchenko, A., Lanze, F., Zinnen, A., Henze, M., Pennekamp, J., Wehrle, K., & Engel, T. (2016) · Proceedings 2016 Network and Distributed System Security Symposium · doi:10.14722/ndss.2016.23477 · Cited by 645 · cited 1×
“[17] present a website fingerprinting attack on Tor that outperforms related”
BackgroundWebsite fingerprinting in onion routing based anonymization networks
Panchenko, A., Niessen, L., Zinnen, A., & Engel, T. (2011) · ACM Workshop on Privacy in the Electronic Society (WPES) · doi:10.1145/2046556.2046570 · Cited by 531 · cited 1×
“Similar work was proposed by Panchenko et al. [18].”
MethodPeek-a-Boo, I Still See You: Why Efficient Traffic Analysis Countermeasures Fail
Dyer, K. P., Coull, S. E., Ristenpart, T., & Shrimpton, T. (2012) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2012.28 · Cited by 478 · cited 3×
“[16] presented web-page fingerprinting attacks and discussed their effectiveness despite traffic analysis countermeasures (e.”
BackgroundMethodInfluentialA first look at traffic on smartphones
Falaki, H., Lymberopoulos, D., Mahajan, R., Kandula, S., & Estrin, D. (2010) · ACM/SIGCOMM Internet Measurement Conference · doi:10.1145/1879141.1879176 · Cited by 453
Herrmann, D., Wendolsky, R., & Federrath, H. (2009) · doi:10.1145/1655008.1655013 · Cited by 423 · cited 1×
“Subsequently, Herman et al. [17] outperformed Liberatore et al. by presenting a method that relies on common text mining techniques to the normalized frequency distribution of observable IP packet sizes.”
MethodTraffic Analysis: Protocols, Attacks, Design Issues, and Open Problems
Raymond, J.-F. (2001) · Lecture notes in computer science · doi:10.1007/3-540-44702-4_2 · Cited by 422 · cited 1×
“With the advent of CDNs and standard web service APIs, more apps are sending their traffic to similar endpoints, and this frustrates attempts to fingerprint app traffic based on destination IP address only.”
Background
Research works printed but not linked: 5
- software, 2014, Network Log
- bacic, 2015, Are You Using A Content Delivery Network For Your Website Yet? You Should Be
- muehlstein, 2016, Analyzing HTTPS encrypted traffic to identify user operating system browser and application
- miller, 2014, I Know Why You Went to the Clinic Risks and Realization of HTTPS Traffic Analysis, 143
- stöber, 2013, Who do you sync you are?: Smartphone fingerprinting via application behaviour, Proc 6th ACM Conf Secur Privacy Wirel Mobile Netw (WiSec), 7
Cited by
Sorted by citations
Items 201–300 of 439
Machine Learning Techniques for Malware Detection
Harsha, A. K., & Thyagaraja Murthy, A. (2021) · International Journal of Scientific Research in Science Engineering and Technology · doi:10.32628/ijsrset21858 · Cited by 6
TraceDroid: A Robust Network Traffic Analysis Framework for Privacy Leakage in Android Apps
Cui, H., Meng, G., Zhang, Y., Wang, W., Zhu, D., Su, T., Zhang, X., & Li, Y. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-17551-0_35 · Cited by 6
TrafficDiary: User Attribute Inference Based on Smart Home Traffic Traces
Yao, Y., Hou, J., Yuan, M., Zhang, H., Xu, Z., & Li, X. (2025) · ACM Transactions on Internet Technology · doi:10.1145/3736762 · Cited by 5
“These attacks encompass techniques like website fingerprint attacks [7, 13, 16, 19, 20] and mobile app fingerprint attacks [2, 9, 10, 15, 21, 24, 28, 30, 31], which can be easily deployed on mobile devices for real-time traffic analysis [32, 33].”
TrafficCLIP: A lightweight cross-modal framework for network traffic classification
Chen, R., Luo, L., Guo, D., Wang, X., Li, S., & Qiu, C. (2025) · Computer Networks · doi:10.1016/j.comnet.2025.111662 · Cited by 5
ExpMD: an Explainable Framework for Traffic Identification Based on Multi-Domain Features
Yang, L., Wang, Y., Liu, L., Huang, J., & Fu, S. (2024) · International Workshop on Quality of Service · doi:10.1109/iwqos61813.2024.10682894 · Cited by 5
Gene Fingerprinting: Cracking Encrypted Tunnel with Zero-Shot Learning
Ding, L. I., Gu, C., & Yuefei, Z. H. U. (2022) · IEICE Transactions on Information and Systems · doi:10.1587/transinf.2021edp7179 · Cited by 5
VT-GAT: A Novel VPN Encrypted Traffic Classification Model Based on Graph Attention Neural Network
Xu, H., Li, S., Cheng, Z., Qin, R., Xie, J., & Sun, P. (2022) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-031-24386-8_24 · Cited by 6
Hu, X., Shu, Z., Tong, Z., Cheng, G., Li, R., & Wu, H. (2023) · Computer Networks · doi:10.1016/j.comnet.2023.110110 · Cited by 5
A Critical Study of Few-Shot Learning for Encrypted Traffic Classification
Akbari, E., Tahmid, S. A., Malekghaini, N., Salahuddin, M. A., Limam, N., Boutaba, R., Mathieu, B., Moteau, S., & Tuffin, S. (2023) · International Conference on Network and Service Management (CNSM) · doi:10.23919/cnsm59352.2023.10327851 · Cited by 5
“Numerous prior works [2]–[4], [13] have found an acute drop in performance, when a model is trained and evaluated on different datasets.”
BackgroundWang, X., Lu, Z., Wang, X., He, M., & Wang, X. (2024) · IEEE Transactions on Cognitive Communications and Networking · doi:10.1109/tccn.2024.3400825 · Cited by 5
Huang, J., Liu, W., Liu, G., Gao, B., & Nie, F. (2025) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2025.3549149 · Cited by 5
“In the realm of classical machine learning-based traffic identification algorithms, AppScanner (AppS) is a notable method [7].”
On the Resilience of Network-based Moving Target Defense Techniques Against Host Profiling Attacks
Piskozub, M., Spolaor, R., Conti, M., & Martinović, I. (2019) · ACM Workshop on Moving Target Defense (MTD) · doi:10.1145/3338468.3356825 · Cited by 5
“, peer-to-peer, HTTP) [33, 50] to inferring used apps and user actions on mobile devices [16, 44].”
MethodSelf-citationUnveiling Radio Resource Utilization Dynamics of Mobile Traffic through Unsupervised Learning
Rago, A., Piro, G., Trinh, H. D., Boggia, G., & Dini, P. (2019) · Network Traffic Measurement and Analysis Conference (TMA) · doi:10.23919/tma.2019.8784692 · Cited by 5
“At the time of writing, the majority of works in this direction try to classify the applications running on mobile terminals by means of the Random Forest algorithm [5] [6] [7].”
BackgroundScoccia, G. L., Kanj, I., Malavolta, I., & Razavi, K. (2020) · IEEE/ACM International Conference on Mobile Software Engineering and Systems (MOBILESoft) · doi:10.1145/3387905.3388594 · Cited by 5
“In the context of Android, multiple studies have investigated potential techniques for app fingerprinting, leveraging network traffic patterns [9, 44, 45, 52], power consumption [5], memory footprints [22], and UI states [4].”
BackgroundHa, J., & Roh, H. (2021) · Electronics · doi:10.3390/electronics10243180 · Cited by 5
Subspace clustering via graph auto-encoder network for unknown encrypted traffic recognition
Yang, R., Yu, A., Cai, L., & Meng, D. (2022) · Cybersecurity · doi:10.1186/s42400-022-00131-y · Cited by 4
“Most machine learning methods used for encrypted traffic recognition are supervised or semi-supervised (Taylor et al. 2017; Anderson and McGrew 2017; Liu et al. 2019).”
The Effect of Network Environment on Traffic Classification
Khesal, A. R., & Teimouri, M. (2022) · International Conference on Computer and Knowledge Engineering · doi:10.1109/iccke57176.2022.9960138 · Cited by 2
“Most traffic classification approaches rely on repetitive behavior in network traffic [4, 5, 8, 12].”
BackgroundMethodInfluentialRamraj, S., & Usha, G. (2023) · International Journal of Advanced Computer Science and Applications · doi:10.14569/ijacsa.2023.01402102 · Cited by 4
“Meanwhile, [11] and [12] are concerned with the privacy involved in network traffic analysis in applications present on the smartphone.”
BackgroundCombo Packet: An Encryption Traffic Classification Method Based on Contextual Information
Chai, Y., Zhu, Y., Wei, L., & Ding, L. (2024) · Computers, materials & continua/Computers, materials & continua (Print) · doi:10.32604/cmc.2024.049904 · Cited by 4
Eavesdropping Mobile Apps and Actions Through Wireless Traffic in the Open World
Yang, X., Huang, Y., Guo, J., Zhang, D., & Wang, Q. (2024) · International Conference on Intelligent Computing · doi:10.1007/978-981-97-5609-4_1 · Cited by 5
“Since apps in smartphones carry a considerable amount of personal privacy information [14,16,17], such as gender, age, and hobbies, it is of great importance to investigate the extent to which smartphones are vulnerable to such attacks [9,2].”
BackgroundEncrypted HTTP/2 Traffic Monitoring: Standing the Test of Time and Space
Brissaud, P.-O., François, J., Chrisment, I., Cholez, T., & Bettan, O. (2020) · IEEE International Workshop on Information Forensics and Security · doi:10.1109/wifs49906.2020.9360895 · Cited by 4
“AppScanner [10] profiles 110 mobile applications with an accuracy between 73% and 96%.”
BackgroundHigh-accuracy model recognition method of mobile device based on weighted feature similarity
Li, R., Wang, X., & Luo, X. (2022) · Scientific Reports · doi:10.1038/s41598-022-26518-y · Cited by 4
“Due to 0 ≤ S(f (Di ,k), f (Dj )) ≤ 1 , according to (5) and (6), we can obtain (7).”
Data Instrumentation From IoT Network Traffic as Support for Security Management
Vergütz, A., dos Santos, B. V., Kantarcı, B., & Nogueira, M. (2023) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2022.3233673 · Cited by 4
“There are works employing feature exploration and ML algorithms to removal of ambiguous traffic [9], to identify applications [10], [11], [12], IoT devices [13], malicious activities [14], [15].”
MethodXu, G., Xu, M., Chen, Y., & Zhao, J. (2023) · Electronics · doi:10.3390/electronics12102313 · Cited by 4
FewFine: Few-shot Malware Traffic Classification Via Transfer Learning based on Fine-tuning Strategy
Liu, X., Shen, M., Cui, L., Ye, K., Jia, J., & Yue, G. (2022) · IEEE Smart World Congress (SWC) · doi:10.1109/smartworld-uic-atc-scalcom-digitaltwin-pricomp-metaverse56740.2022.00080 · Cited by 4
“[11] leverage side-channel data including packet size and direction to indicate the traffic of smartphone apps.”
BackgroundAdaptiveMutate: a technique for privacy preservation
Chaddad, L., Chehab, A., Elhajj, I. H., & Kayssi, A. I. (2019) · Digital Communications and Networks · doi:10.1016/j.dcan.2019.09.002 · Cited by 4
Applications and use Cases of Multilevel Granularity for Network Traffic Classification
Zaki, F., Gani, A., & Anuar, N. B. (2020) · IEEE International Colloquium on Signal Processing & Its Applications (CSPA) · doi:10.1109/cspa48992.2020.9068697 · Cited by 4
“[17] and [34] demonstrated ethical attacks to prove that an attacker may take advantage of application name granularity to determine users’ behavior maliciously.”
BackgroundSAFSN: A Self-Attention Based Neural Network for Encrypted Mobile Traffic Classification
Zhang, C., An, C., Wang, J. H., Zhao, Z., Yu, T., & Wang, J. (2021) · IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData) · doi:10.1109/ithings-greencom-cpscom-smartdata-cybermatics53846.2021.00060 · Cited by 4
Robust Machine Learning for Encrypted Traffic ClassificationPreprint
Dvir, A. Z., Zion, Y., Muehlstein, J., Pele, O., Hajaj, C., & Dubin, R. (2016) · arXiv (Cornell University) · doi:10.48550/arxiv.1603.04865 · Cited by 4
Inferring mobile applications usage from DNS traffic
Campo, C., García-Rubio, C., Jimenez-Berenguel, A., Moure-Garrido, M., Almenárez, F., & Sánchez, D. D. (2024) · Ad hoc networks · doi:10.1016/j.adhoc.2024.103601 · Cited by 6
Xi, T., Zheng, Q., Chuanhui, C., Wu, T., Xie, G., Qian, X., Ye, H., & Sun, Z. (2025) · Future Internet · doi:10.3390/fi17030114 · Cited by 3
“AppScanner [15] used a support vector classifier (SVC) and random forest (RF) to classify traffic based on 54 features of mobile traffic [3].”
RTQS: Real-time flow fairness queue scheduling policy on router devices
Zhang, H., Xu, Z., Han, F., Li, F., & Li, Q. (2025) · Computer Networks · doi:10.1016/j.comnet.2025.111443 · Cited by 4
MFF: A Multimodal Feature Fusion Approach for Encrypted Traffic Classification
Huang, H., Zhou, Y., Jiang, F., Zhou, X., & Jiang, Q. (2025) · Electronics · doi:10.3390/electronics14132584 · Cited by 3
Fingerprinting Deep Learning Models via Network Traffic Patterns in Federated Learning
Shuvo, M. N. H., & Hossain, M. (2025) · ACM Workshop on Wireless Security and Machine Learning (WiseML) · doi:10.1145/3733965.3733968 · Cited by 3
“In [18] [9].”
Analyzing the impact of shifts in encrypted mobile-app traffic on multimodal few-shot learning
Monda, D. D., Bovenzi, G., Montieri, A., Persico, V., & Pescapè, A. (2025) · Computer Networks · doi:10.1016/j.comnet.2025.111935 · Cited by 3
A Novel Method with Transformers for Fine-grained Encrypted Traffic Classification
Kong, H., Li, T., Ge, J., Li, H., Yang, L., Zhuang, L., Xu, Z., & Xie, C. (2023) · IEEE International Conference on High Performance Computing and Communications; IEEE International Conference on Smart City; IEEE International Conference on Data Science and Systems (HPCC/SmartCity/DSS) · doi:10.1109/hpcc-dss-smartcity-dependsys60770.2023.00020 · Cited by 3
Network traffic classification based‐ masked language regression model using CNN
Steffi, P. L., Emmanuel, W. R. S., & Rani, P. A. J. (2024) · Concurrency and Computation Practice and Experience · doi:10.1002/cpe.8223 · Cited by 3
Attack Traffic Detection Based on LetNet-5 and GRU Hierarchical Deep Neural Network
Wang, Z., Wang, Z., Yi, F., & Zeng, C. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-86137-7_36 · Cited by 3
Network Traffic Analysis Using Machine Learning Techniques in IoT Networks
Mishra, S. (2022) · International Journal of Software Innovation · doi:10.4018/ijsi.289172 · Cited by 4
Choo, E., Nabeel, M., AlSabah, M., Khalil, I. M., Yu, T., & Wang, W. (2022) · ACM Transactions on Privacy and Security · doi:10.1145/3558767 · Cited by 4
“Mobile users mostly access contents through apps in their devices [58].”
BackgroundMetainformation Extraction from Encrypted Streaming Video Packet Traces
Duvignau, R. (2022) · International Conference on Electrical, Computer, Communications and Mechatronics Engineering (ICECCME) · doi:10.1109/iceccme55909.2022.9988476 · Cited by 3
“[15] studied the recognition of encrypted YouTube packet traces and also proposed to follow a SVM approach as in [4].”
BackgroundMethodPositive and Unlabeled Learning for Mobile Application Traffic Classification
Hussey, J., Stone, K., & Camp, T. K. (2022) · IEEE Military Communications Conference (MILCOM) · doi:10.1109/milcom55135.2022.10017699 · Cited by 3
“In [19], this same research team extended the framework from [18], explicitly addressing the weakness in handling ambiguous traffic flows.”
BackgroundVideo Stream Recognition Using Bitstream Shape for Mobile Network QoE
Chmieliauskas, D., & Paulikas, Š. (2023) · Sensors · doi:10.3390/s23052548 · Cited by 4
“Acquiring data from actual users, rather than using synthetic bot-generated data, provides a more precise representation compared with other research [14,21].”
ResultActivity Detection from Encrypted Remote Desktop Protocol Traffic
Lapczyk, L., & Skillicorn, D. B. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-32636-3_14 · Cited by 3
Characterizing Mobile Applications Through Analysis of DNS Traffic
Jimenez-Berenguel, A., Moure-Garrido, M., García-Rubio, C., & Campo, C. (2023) · ACM International Workshop on Performance Evaluation of Wireless Ad Hoc, Sensor, and Ubiquitous Networks · doi:10.1145/3616394.3618268 · Cited by 3
“Taylor et al. [25] extended the work of AppScanner by using the same machine learning technique to classify mobile apps.”
MethodPrecise Wireless Camera Localization Leveraging Traffic-Aided Spatial Analysis
He, Y. Z., He, Q., Fang, S., & Liu, Y. (2023) · IEEE Transactions on Mobile Computing · doi:10.1109/tmc.2023.3333272 · Cited by 3
“Unlike existing traffic analysis based approaches (e.g., [11], [50], [51], [52]), which utilize the inherent traffic patterns to detect devices or apps which generate them, our work correlates the traffic pattern with human activities.”
BackgroundHe, Y. Z., He, Q., Fang, S., & Liu, Y. (2023) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3576915.3623083 · Cited by 3
“…variety of applications, from classifying the traffic’s nature (e.g., video streaming and p2p traffic) [61] to revealing fine-grained App usage [60, 73] or even user actions on Apps [10, 26, 74], and from unveiling streamed YouTube videos [47] to identifying IoT devices including drones [12, 58,…”
BackgroundIoT Device Identification Base on Inter-flow Correlation Analysis Using Graph Neural Network
Peng, C., Tan, X., Xie, P., Li, M., Wang, H., & Chen, S.-W. (2023) · International Conference on Big Data Computing and Communications · doi:10.1109/bigcom61073.2023.00012 · Cited by 1
Liang, Y.-L., Wang, F., Chen, S.-H., Chen, B., & Bo, Y. (2024) · Computer Communications · doi:10.1016/j.comcom.2024.02.010 · Cited by 6
Multi-Granularity Feature Fusion for Enhancing Encrypted Traffic Classification
Ding, Q., Zha, Z., Li, Y., & Ling, Z.-H. (2024) · International Journal of Advanced Computer Science and Applications · doi:10.14569/ijacsa.2024.01504110 · Cited by 3
Enhancing VPN Traffic Recognition Through CatBoost Feature Extraction and Stacking Ensemble Learning
Huang, K., Zhou, M. Q., Zhang, P., Qin, X., & Hu, X. (2024) · International Conference on Communications · doi:10.1109/icc51166.2024.10622256 · Cited by 3
Analysis of corporate network cyber threats based on parallel processing of Netflow data
Дмитриевич, К. Д., & Владиславович, И. С. (2023) · Siberian Aerospace Journal · doi:10.31772/2712-8970-2023-24-4-663-672 · Cited by 4
Cai, Y., Shu, L., Zhang, H., Liu, Y., Du, M., & Fang, B. (2024) · Conference proceedings/Conference proceedings - IEEE International Conference on Systems, Man, and Cybernetics · doi:10.1109/smc54092.2024.10831226 · Cited by 3
“ML-based methods used a set of hand-crafted features such as packet size statistics [8], packet transmission times [11], and frequency domain features [12], employing algorithms such as AutoEncoder [13] and random forests [8].”
I Know Who You are: A Learning Framework to Profile Smartphone Users
Mihika, N., Bhatia, A., & Tiwari, K. (2020) · International Conference on Communication Systems & Networks (COMSNETS) · doi:10.1109/comsnets48256.2020.9027343 · Cited by 3
“In [13] and [16] the goal is to identify smartphone apps in use using side channel data.”
BackgroundTrCMP: An App Usage Inference Method for Mobile Service Enhancement
Zhao, X., Bhuiyan, M. Z. A., Qi, L., Nie, H., Rafique, W., & Dou, W. (2018) · Lecture notes in computer science · doi:10.1007/978-3-030-05345-1_19 · Cited by 3
Understanding and Improving Video Fingerprinting Attack Accuracy under Challenging Conditions
Carlson, A., Hasselquist, D., Witwer, E., Johansson, N., & Carlsson, N. F. (2023) · Workshop on Privacy in the Electronic Society · doi:10.1145/3689943.3695045 · Cited by 3
“These including identifying specific subpages visited within a website [24, 61]; determining messaging traffic details and app usage [6, 12, 19, 39, 65]; extracting VoIP transcripts and voice assistant activity [2, 3, 8, 37, 71]; fingerprinting live streams via associated chat traffic [25]; and…”
Mahboob, T., & Chung, M. Y. (2025) · Annals of Telecommunications · doi:10.1007/s12243-025-01106-z · Cited by 2
Robustness Matters: Pre-Training Can Enhance the Performance of Encrypted Traffic Analysis
Yang, L., Liu, L., Huang, J., Shi, J., Fu, S., Wang, Y., & Su, J. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3613970 · Cited by 2
Chen, Z., Cheng, G., Niu, D., Zhao, Y., Zhou, Y., & Jiang, S. (2025) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2025.3615592 · Cited by 2
“Encrypted traffic is essentially a packet sequence in the network [37].”
Smartphone User Fingerprinting on Wireless Traffic
Huang, Y., Dong, Z., Yang, X., Zhang, D., Wang, Q., & Wang, Z.-H. (2025) · IEEE Transactions on Mobile Computing · doi:10.1109/tmc.2025.3628474 · Cited by 1
“Since smartphones carry a considerable amount of personal privacy information [7], [8], [9], [10], [11], [12], such as gender, age, and hobbies [13], [14], [15], it is of great importance to investigate the extent to which smartphones are vulnerable to such attacks [16], [17], [18].”
Efficient Network Traffic Analysis Using Large-Parameter LLMs on Consumer-Grade GPUs
Wei, X., Wang, Z., Chen, D., & You, L. (2025) · Mathematics · doi:10.3390/math13233754 · Cited by 2
A Real-Time Channel-Level Intrusion Detection System Based on Multimodal Learning
Zhao, X., He, M., & Wang, X. (2026) · IEEE Internet of Things Journal · doi:10.1109/jiot.2026.3651905 · Cited by 3
Mehavilla, L., García, J., & Alesanco, Á. (2026) · Knowledge-Based Systems · doi:10.1016/j.knosys.2026.115893 · Cited by 2
Mobile traffic classification through burst traffic statistical features
Anamuro, C. V., & Lagrange, X. (2023) · IEEE Vehicular Technology Conference · doi:10.1109/vtc2023-spring57618.2023.10200032 · Cited by 2
Depicting Instant Messaging Encrypted Traffic Characteristics through an Empirical Study
Erdenebaatar, Z., Alshammari, R., Nandy, B., Seddigh, N., Elsayed, M. A., & Zincir-Heywood, N. (2023) · International Conference on Computer Communications and Networks (ICCCN) · doi:10.1109/icccn58024.2023.10230093 · Cited by 2
“This is because existing research employs either network traffic data that cannot be publicly available, or datasets built upon real user traffic [2].”
BackgroundIntelligent Traffic-Service Mapping of Network for Advanced Industrial IoT Edge Computing
Liu, B., Zheng, T., Thar, K., Gidlund, M., Ma, X., Lei, B., Zhang, H., & Guizani, M. (2024) · IEEE International Workshop on Factory Communication Systems (WFCS) · doi:10.1109/wfcs60972.2024.10540782 · Cited by 2
Characterizing Encrypted Application Traffic Through Cellular Radio Interface Protocol
Islam, M. R., Anwar, R. H., Mastorakis, S., & Raza, M. T. (2024) · IEEE International Conference on Mobile Ad-Hoc and Sensor Systems (MASS) · doi:10.1109/mass62177.2024.00050 · Cited by 2
A Study on Application Category Estimation Method Based on Burst Characteristics of Communication
Aoki, H., Ozu, T., Hasegawa, A., & Yokoyama, H. (2022) · IEEE Annual Computing and Communication Workshop and Conference (CCWC) · doi:10.1109/ccwc54503.2022.9720850 · Cited by 2
TSA: a tool to detect and quantify network side-channels
Kadron, İ. B., & Bultan, T. (2022) · ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) · doi:10.1145/3540250.3558938 · Cited by 2
“3558938 actions or data on mobile applications, websites or IoT devices [1, 9].”
BackgroundDetecting Android Side Channel Probing Attacks Based on System States
Lin, Q., Mao, J., Shi, F., Zhu, S., & Liang, Z. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-23597-0_16 · Cited by 2
Adversarial Malicious Encrypted Traffic Detection Based on Refined Session Analysis
Li, M., Wu, Z., Chen, K., & Wang, W. (2022) · Symmetry · doi:10.3390/sym14112329 · Cited by 2
A Review on Internet Traffic Classification Based on Artificial Intelligence Techniques
Malek, M. P., Naderi, S., & Garakani, H. G. (2022) · International Journal of Information & Communication Technology Research · doi:10.52547/itrc.14.2.1 · Cited by 2
RTD: The Road to Encrypted Video Traffic Identification in the Heterogeneous Network Environments
Xu, M., Du, M., Li, Z., Deng, Z., Yang, W., & Liu, Q. (2022) · IEEE International Conference on High Performance Computing and Communications; IEEE International Conference on Smart City; IEEE International Conference on Data Science and Systems (HPCC/SmartCity/DSS) · doi:10.1109/hpcc-dss-smartcity-dependsys57074.2022.00257 · Cited by 2
AppHunter: Mobile Application Traffic Classification
Swarnkar, M., Hubballi, N., Tripathi, N., & Conti, M. (2018) · IEEE International Conference on Advanced Networks and Telecommunications Systems · doi:10.1109/ants.2018.8710170 · Cited by 2
“[20], transmitted and received bytes for each action in each application [21], [22] are used to generate signatures which are then used by various machine learning algorithms for application classification purpose.”
MethodSelf-citationiMonitor, An APP-Level Traffic Monitoring and Labeling System for iOS Devices
Liu, J., Wang, F., Zhao, S., Wang, X., & Chen, S. (2019) · IEEE International Conference on Computational Science and Engineering (CSE) and IEEE International Conference on Embedded and Ubiquitous Computing (EUC) · doi:10.1109/cse/euc.2019.00048 · Cited by 2
“Researchers have tried to recognize apps using packet headers or HTTP request headers [22]–[24], statistical characteristics of packets [25].”
BackgroundSide-Channel Information Leakage of Traffic Data in Instant Messaging
Li, K., Li, H., Zhu, H., Sun, L., & Wen, H. (2019) · IEEE International Performance, Computing, and Communications Conference · doi:10.1109/ipccc47392.2019.8958775 · Cited by 2
“[9] identified smartphone apps and investigated how app fingerprints change over time, across devices, and across different version of apps.”
BackgroundRandom forest based pseudorandom sequences classification algorithm
Kozachok, A. V., Spirin, A. A., & Golembiovskaya, O. (2020) · Proceedings of Tomsk State University of Control Systems and Radioelectronics · doi:10.21293/1818-0442-2020-23-3-55-60 · Cited by 2
Privacy-Aware Access Protocols for MEC Applications in 5G
Akman, G., Ginzboorg, P., & Niemi, V. (2022) · Network · doi:10.3390/network2020014 · Cited by 2
“Still, traffic analysis may help in identifying the MEC application in use; see [58,59].”
BackgroundBayat, M., Garshasbi, J., Mehdizadeh, M., Nozari, N., Khesal, A. R., Dokaei, M., & Teimouri, M. (2023) · SSRN Electronic Journal · doi:10.2139/ssrn.4661706 · Cited by 2
User Mobile App Encrypted Activity Detection
Pathmaperuma, M. H., Rahulamathavan, Y., Dogan, S., & KONDOZ, A. M. (2021) · doi:10.1145/3478301.3478303 · Cited by 1
“Coull and Dyer [6] conducted a research on Apple iMessage service and showed the possibility to identify five user actions related to instant messaging apps.”
BackgroundIntegration of Smart Wearable Devices and Cloud Computing in the Kenyan Public Health Care System
Ngayua, E. N. (2021) · doi:10.7176/ikm/11-4-04 · Cited by 1
“A sign-up procedure will be used to obtain the user’s identity and permission to ensure data safety (Taylor et al., 2018).”
Byte Segmented Convolutional Neural Network for Network Traffic Classification
Pepsi, M. B. B., Aruna, M., Deepika, J., & SoundharyaGomathi, S. (2023) · International Conference on Optimization Techniques for Learning (ICOTL) · doi:10.1109/icotl59758.2023.10434992 · Cited by 1
“As a result, current research typically first capture side-channel data sequences before transforming them into characteristics appropriate for machine learning [13].”
BackgroundMethodFEAML: A Mobile Traffic Classification System with Feature Expansion and Autonomous Machine Learning
Yang, Q. F., Kong, X., Xiao, Y., Lin, Y., Wen, R., & Qi, H. (2024) · Lecture notes in computer science · doi:10.1007/978-981-97-0808-6_20 · Cited by 1
An Encrypted Traffic Classification Framework Based on Higher-Interaction-Graph Neural Network
Hu, Z., Qu, B., Li, X., & Li, C. (2024) · Lecture notes in computer science · doi:10.1007/978-981-97-5101-3_21 · Cited by 2
Zero-Shot Traffic Identification with Attribute and Graph-Based Representations for Edge Computing
Lu, Z., Chang, Z., He, M., & Song, L. (2025) · Sensors · doi:10.3390/s25020545 · Cited by 2
Wang, L., Wang, W., Jiang, W. P., Zhang, B., Zhu, Q., Deng, J., & Wu, J. (2024) · IEEE International Conference on Network Protocols (ICNP) · doi:10.1109/icnp61940.2024.10858562 · Cited by 1
Huang, H., Zhou, Y., & Jiang, F. (2025) · Mathematics · doi:10.3390/math13060973 · Cited by 4
Hilgert, J.-N., & Lambertz, M. (2025) · doi:10.1145/3712716.3712723 · Cited by 1
“Beyond these, much of the existing research focuses on identifying and fingerprinting applications within network traffic rather than reconstructing high-level events[17, 20, 21].”
Encryption Traffic Classification Based on Mining Traffic Context and Transport Relationship
Gai, W., Zhang, R., Zhang, H., Guo, Y. H., Yin, J., & Zhang, P. (2025) · IEEE Wireless Communications and Networking Conference · doi:10.1109/wcnc61545.2025.10978781 · Cited by 1
“Among them, AppScanner [4] uses the statistical feature of packet size to train the random forest classifier, while BIND [5] uses the statistical feature of time.”
Harinath, K. R., & Kumar, G. (2025) · International Journal of Computational and Experimental Science and Engineering · doi:10.22399/ijcesen.1377 · Cited by 2
“…with the data employed in our own methodology are: Fingerprint construction approach: FlowPrint [48]; Statistical feature approaches: AppScanner [50], CUMUL [49], BIND [51], and k-fingerprinting (K-fp) [54]; Deep learning approaches: deep fingerprinting (DF) [52], FS-Net [53], GraphDApp [54]…”
ET-Former: Robust Transformer-Based Representation for Encrypted Traffic Classification
Wu, C., Zhao, L., Yu, A., Cai, L., & Meng, D. (2025) · International Conference on Computer Supported Cooperative Work in Design (CSCWD) · doi:10.1109/cscwd64889.2025.11033479 · Cited by 1
MalTAG: Encrypted Malware Traffic Detection Framework via Graph Based Flow Interaction Mining
Li, R., Zhou, Z., Hao, M., Shi, F., & Liu, Q. (2025) · International Conference on Dependable Systems & Networks/Proceedings · doi:10.1109/dsn64029.2025.00052 · Cited by 1
MS-PreTE: A Multi-Scale Pre-Training Encoder for Mobile Encrypted Traffic Classification
Wang, Z., Qiu, Y., Liu, Y., Zhang, S., & Liu, X. (2025) · Big Data and Cognitive Computing · doi:10.3390/bdcc9080216 · Cited by 2
Real-Time Application Identification Scheme and Evaluation Method Using Machine Learning
Ou, T., & Nakao, A. (2025) · International Conference on Communications · doi:10.1109/icc52391.2025.11162105 · Cited by 1
“Taylor et al. [7] use 54 statistical features, including the average, minimum, and maximum of the transmission (upstream) packet size and reception (downstream) packet size (packet length), to identify 110 types of applications.”
InVue: Inferring Vulnerabilities from Encrypted Web Traffic
Burroughs, W. A., & Li, Q. (2025) · IEEE International Conference on Communications, Control, and Computing Technologies for Smart Grids (SmartGridComm) · doi:10.1109/smartgridcomm65349.2025.11204622 · Cited by 1
TrafficMAE: A network traffic classification model based on masked autoencoder
Zhu, W.-J., Zhang, H., Pei, C.-H., & Li, J. (2025) · ICT express · doi:10.1016/j.icte.2025.11.004 · Cited by 1
From Packets to Semantics: Transformer-Driven Privacy-Preserving ETA for OTT App Classification
Hassan, A., Rauf, A., Latif, R., Baig, A. I., & Kanso, H. (2025) · IEEE Access · doi:10.1109/access.2025.3640294 · Cited by 1
“Despite these advancements, TLS 1.3 does not obscure all metadata; characteristics such as packet-size distributions, transmission timing, and flow directionality remain observable even in encrypted streams [7], [8].”
InfluentialHierarchical Byte-Level Modeling via CNN and Mamba for Encrypted Traffic Classification
Liu, L., Guo, S., He, Y. C., & Hu, N. (2025) · IEEE International Conference on Data Science in Cyberspace · doi:10.1109/dsc67331.2025.00034 · Cited by 1
“In many previous studies [1], [2], even packet-level *Corresponding author statistical features, such as inter-arrival times, packet lengths, or flow durations—are obfuscated or highly volatile, leading to significant degradation in model performance.”
Zheng, C.-F., Ma, H.-L., Qu, Y., Jiang, Y., & Wang, W. (2026) · Comput. Networks · doi:10.1016/j.comnet.2026.112122
Encrypted Network Traffic Feature Extraction for Application Classification
최양서, Yu, J., Koo, K., & Moon, D. (2025) · International Conference on Information and Communication Technology Convergence (ICTC) · doi:10.1109/ictc66702.2025.11388796 · Cited by 1
Metadata
- Authors
- Taylor, V. F., Spolaor, R., Conti, M., & Martinovic, I.
- Affiliations
- University of Oxford (GB)
- University of Padua (IT)
- Venue
- IEEE Transactions on Information Forensics and Security
- Published
- 2018-01
- Volume
- 13
- Issue
- 1
- Pages
- 63-78
- ISSN
- 1556-6013 (ISSN-L)
- 1556-6021
- OpenAlex
- W2609737443
- Cited by
- 439
- References
- 30
- Citations by year
- 2026: 47 · 2025: 69 · 2024: 63 · 2023: 55 · 2022: 60 · 2021: 45 · 2020: 41 · 2019: 39 · 2018: 18
- FWCI
- 16.15
- Type
- journal article
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- IEEE Transactions on Information Forensics and Security (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- Padua Research Archive (University of Padova) (submittedVersion, other-oa)
- arXiv (Cornell University)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Physical Sciences › Computer Science › Information Systems › Digital and Cyber Forensics
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Keywords
- encrypted traffic analysis, packet size, SSL/TLS, passive eavesdropping, privacy leakage
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
