The DOI matches its Crossref record, with a small difference in title or year; 30 of the 30 references it cites were found in a registry or an index.
Robust Smartphone App Identification via Encrypted Network Traffic Analysis
Open accessAbstract
The apps installed on a smartphone can reveal much information about a user, such as their medical conditions, sexual orientation, or religious beliefs. In addition, the presence or absence of particular apps on a smartphone can inform an adversary, who is intent on attacking the device. In this paper, we show that a passive eavesdropper can feasibly identify smartphone apps by fingerprinting the network traffic that they send. Although SSL/TLS hides the payload of packets, side-channel data, such as packet size and direction is still leaked from encrypted connections. We use machine learning techniques to identify smartphone apps from this side-channel data. In addition to merely fingerprinting and identifying smartphone apps, we investigate how app fingerprints change over time, across devices, and across different versions of apps. In addition, we introduce strategies that enable our app classification system to identify and mitigate the effect of ambiguous traffic, i.e., traffic in common among apps, such as advertisement traffic. We fully implemented a framework to fingerprint apps and ran a thorough set of experiments to assess its performance. We fingerprinted 110 of the most popular apps in the Google Play Store and were able to identify them six months later with up to 96% accuracy. Additionally, we show that app fingerprints persist to varying extents across devices and app versions.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“These methods highly rely on expert-designed features and have limited generalization ability.”
From ET-BERT: A Contextualized Datagram Representation with Pre-training Transformers for Encrypted Traffic Classification (2022) · cites this paper as [36]
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Data Structures for Statistical Computing in Python
McKinney, W. (2010) · Proceedings of the Python in Science Conferences · doi:10.25080/majora-92bf1922-00a · Cited by 12,930 · cited 1×
“These statistical features are computed using the Python pandas [32] library.”
MethodAPI design for machine learning software: experiences from the scikit-learn projectPreprint
Buitinck, L., Louppe, G., Blondel, M., Pedregosa, F., Mueller, A., Grisel, O., Niculae, V., Prettenhofer, P., Gramfort, A., Grobler, J., et al. (2013) · arXiv (Cornell University) · doi:10.48550/arxiv.1309.0238 · Cited by 2,387 · cited 1×
“We leveraged the scikit-learn [34] machine learning libraries to implement the classifiers in our framework.”
MethodA survey of techniques for internet traffic classification using machine learning
Nguyen, T. T. T., & Armitage, G. (2008) · IEEE Communications Surveys & Tutorials · doi:10.1109/surv.2008.080406 · Cited by 1,664 · cited 1×
“Network traffic fingerprinting is not a new area of research, and indeed the literature exemplifies techniques for network traffic classification on traditional computers [7].”
BackgroundDynodroid: an input generation system for Android apps
Machiry, A., Tahiliani, R., & Naik, M. (2013) · ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) · doi:10.1145/2491411.2491450 · Cited by 702
Website Fingerprinting at Internet Scale
Panchenko, A., Lanze, F., Zinnen, A., Henze, M., Pennekamp, J., Wehrle, K., & Engel, T. (2016) · Proceedings 2016 Network and Distributed System Security Symposium · doi:10.14722/ndss.2016.23477 · Cited by 645 · cited 1×
“[17] present a website fingerprinting attack on Tor that outperforms related”
BackgroundWebsite fingerprinting in onion routing based anonymization networks
Panchenko, A., Niessen, L., Zinnen, A., & Engel, T. (2011) · ACM Workshop on Privacy in the Electronic Society (WPES) · doi:10.1145/2046556.2046570 · Cited by 531 · cited 1×
“Similar work was proposed by Panchenko et al. [18].”
MethodPeek-a-Boo, I Still See You: Why Efficient Traffic Analysis Countermeasures Fail
Dyer, K. P., Coull, S. E., Ristenpart, T., & Shrimpton, T. (2012) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2012.28 · Cited by 478 · cited 3×
“[16] presented web-page fingerprinting attacks and discussed their effectiveness despite traffic analysis countermeasures (e.”
BackgroundMethodInfluentialA first look at traffic on smartphones
Falaki, H., Lymberopoulos, D., Mahajan, R., Kandula, S., & Estrin, D. (2010) · ACM/SIGCOMM Internet Measurement Conference · doi:10.1145/1879141.1879176 · Cited by 453
Herrmann, D., Wendolsky, R., & Federrath, H. (2009) · doi:10.1145/1655008.1655013 · Cited by 423 · cited 1×
“Subsequently, Herman et al. [17] outperformed Liberatore et al. by presenting a method that relies on common text mining techniques to the normalized frequency distribution of observable IP packet sizes.”
MethodTraffic Analysis: Protocols, Attacks, Design Issues, and Open Problems
Raymond, J.-F. (2001) · Lecture notes in computer science · doi:10.1007/3-540-44702-4_2 · Cited by 422 · cited 1×
“With the advent of CDNs and standard web service APIs, more apps are sending their traffic to similar endpoints, and this frustrates attempts to fingerprint app traffic based on destination IP address only.”
Background
Research works printed but not linked: 5
- software, 2014, Network Log
- bacic, 2015, Are You Using A Content Delivery Network For Your Website Yet? You Should Be
- muehlstein, 2016, Analyzing HTTPS encrypted traffic to identify user operating system browser and application
- miller, 2014, I Know Why You Went to the Clinic Risks and Realization of HTTPS Traffic Analysis, 143
- stöber, 2013, Who do you sync you are?: Smartphone fingerprinting via application behaviour, Proc 6th ACM Conf Secur Privacy Wirel Mobile Netw (WiSec), 7
Cited by
Sorted by citations
Items 301–400 of 439
Zhao, X., He, M., Yang, L., Zhao, J., & Wang, X. (2026) · IEEE Transactions on Network Science and Engineering · doi:10.1109/tnse.2026.3664905 · Cited by 1
“…rely on statistical features extracted from bidirectional flows (e.g., total packet count, packet inter-arrival time, flow duration, etc.) [13], [14], [15], [16], [17], [18], [19], [20], [21], [22], [80], combined with machine learning algorithms to achieve traffic classification and recognition…”
Zhang, X., Zhang, T.-K., Liu, Y.-L., & Cheng, W. (2025) · International Conference on Speech Technology and Human-Computer Dialogue · doi:10.1109/icct67417.2025.11374239 · Cited by 1
“Statistical feature-driven method: Machine learning methods represented by AppScanner, CUMUL [5].”
Learning Flow Semantics for Encrypted Traffic Analysis: A Contrastive Pre-Training Approach
Zhao, R., Zhan, M., Li, Q., Liu, Z., Deng, X., Wang, Y., Cheng, G., Xue, Z., & Xu, K. (2026) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2026.3677663 · Cited by 1
“Numerous security tasks are based on traffic analysis, such as application identification [1], [2], [3], malware detection [4], [5], [6], and attack detection [7], [8], [9].”
Nisa, M. U., Mian, A. N., & Rehmani, M. H. (2026) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2026.3683528 · Cited by 1
Xu, S.-J., Kong, K., & Liu, Y. (2026) · International Conference on Artificial Intelligence and Industrial Technology Applications (AIITA) · doi:10.1109/aiita69518.2026.11567363 · Cited by 1
NeuRO: Inference-time Profiling and Orchestration of ML Applications at the Edge
Javeed, A., Dán, G., & Fodor, V. (2026) · IEEE Conference on Computer Communications (INFOCOM) · doi:10.1109/infocom59046.2026.11571347 · Cited by 1
HALO: Revealing the inadequacy of backdoor defenses in encrypted traffic classification
Wang, S., Geng, J., Zhou, Y., Yang, S., Yang, X., & Wu, D. O. (2026) · Computer Networks · doi:10.1016/j.comnet.2026.112656 · Cited by 1
MAAN: A Multiple Attribute Association Network for Mobile Encrypted Traffic Classification
Shi, F., Zheng, C., Cui, Y., & Liu, Q. (2020) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-030-63086-7_11 · Cited by 1
ZHANG, Y., Ma, X., LENG, D., & YU, P. (2022) · Asia Conference on Electrical, Power and Computer Engineering (EPCE) · doi:10.1145/3529299.3529310 · Cited by 1
“However, researchers [3-19] seldom consider video streaming under complex network environments.”
BackgroundENiD: An Encrypted Web Pages Traffic Identification Based on Web Visiting Behavior
Ge, M., Yu, X., Sachidananda, V., Liu, S., & Liu, L. (2022) · IEEE ... International Conference on Data Mining workshops · doi:10.1109/icdmw58026.2022.00082 · Cited by 1
“These methods have been widely used in encrypted application classification [25] and traffic categories [26] identification.”
MethodHublikar, S., & Shet, N. S. V. (2023) · Advances in Complex Systems · doi:10.1142/s1793962324500119 · Cited by 1
Robust website fingerprinting through resource loading sequence
Li, C., Nie, L., Zhao, L., & Li, K. (2023) · World Wide Web · doi:10.1007/s11280-023-01138-2 · Cited by 2
“[28] propose App-Scanner to extract 54 statistical features from incoming”
BackgroundEfficient Fingerprinting Attack on Web Applications: An Adaptive Symbolization Approach
Yang, X., Xu, J., & Li, G. (2023) · Electronics · doi:10.3390/electronics12132948 · Cited by 1
The Role of Artificial Intelligence in Cyber Security
Arockiasamy, K. (2023) · Advances in information security, privacy, and ethics book series · doi:10.4018/978-1-6684-7110-4.ch001 · Cited by 1
A Testbed for Automating and Analysing Mobile Devices and Their Applications
Simpson, L., Millar, K., Cheng, A., Chew, H. G., & Lim, C. (2023) · International Conference on Machine Learning and Cybernetics · doi:10.1109/icmlc58545.2023.10327947 · Cited by 1
“The most relevant dataset to our work is provided in [22], which is for classification of VPN and non-VPN application traffic of a single mobile device.”
BackgroundPaBiL-Net: Parallel Bidirectional LSTM Network for Mobile Encrypted Traffic Classification
Cheng, B., Wei, F., & Gu, C. (2024) · Communications in computer and information science · doi:10.1007/978-981-99-9331-4_36 · Cited by 1
Multa: Enabling Cost-efficient Multi-task Network Traffic Analysis
Guo, C., Zhang, M., Li, G., & Xu, M. (2023) · Globecom · doi:10.1109/globecom54140.2023.10437133 · Cited by 1
Steffi, P. L., Emmanuel, W. R. S., & Rani, P. A. J. (2024) · Information systems engineering and management · doi:10.1007/978-3-031-61471-2_17 · Cited by 1
Real-Time Application Identification Method for Mobile Networks Using Machine Learning
Ou, T., & Nakao, A. (2024) · IEEE/IFIP Network Operations and Management Symposium (NOMS) · doi:10.1109/noms59830.2024.10575712 · Cited by 1
“We use 36 features summarized in Table 1, referring to those of Taylor et al. [6] and Wang et al. [7].”
BackgroundMethodLi, S.-B., Qiang, Q., Zang, T., Yang, L., & Gao, T. (2024) · IEEE Wireless Communications and Networking Conference · doi:10.1109/wcnc57260.2024.10570907 · Cited by 1
“In [2][3], Taylor et al. proposed AppScanner, which is an effective encrypted App traffic classification method, leveraging machine learning methods to extract statistical features for classification.”
MethodMetadata Privacy Beyond Tunneling for Instant Messaging
Nelson, B., Pagnin, E., & Askarov, A. (2024) · IEEE European Symposium on Security and Privacy · doi:10.1109/eurosp60621.2024.00044 · Cited by 1
“Because Tor can be automatically fingerprinted [5], [6], it is also easy to block (ironically, the authors of this paper themselves were blocked from accessing the Tor project’s website on their university network).”
BackgroundUnidirectional Encrypted Traffic Classification: A Survey
Yang, C., Gu, Z., Wei, Y., Xiong, G., Gou, G., Yao, S., & Yu, Y. (2024) · Asia-Pacific Conference on Image Processing, Electronics and Computers (IPEC) · doi:10.1109/ipec61310.2024.00125 · Cited by 1
Anti-Packet-Loss Encrypted Traffic Classification via Masked Autoencoder
Yang, C., Guo, L., Gu, Z., Gou, G., Lin, X., Xiong, G., & Guan, Y. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-71464-1_7 · Cited by 1
PowerApp: Mobile Apps and User Actions Identification via USB Power Channel Analysis
Spolaor, R., Feng, N., Liu, Y., Cheng, X.-Z., & Hu, P.-F. (2025) · ICC 2025 - IEEE International Conference on Communications · doi:10.1109/icc52391.2025.11161905 · Cited by 2
“Although research work in this direction mainly focuses on fingerprinting of app and user actions using network traffic analysis [7]–[10], preliminary attempts in the domain of physical channels have investigated the use of electromagnetic (EM) and acoustic emissions from wireless charging…”
Self-citationSmartphone Application Identification by Convolutional Neural Network
Zhao, S., & Chen, S. (2018) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-030-00557-3_11 · Cited by 1
Generative Adversarial Networks Based Industrial Protocol Construction in the Fog Computing
Chu, L., & Liu, H. (2018) · Conference on Local Computer Networks · doi:10.1109/lcn.2018.8638069 · Cited by 1
Detecting Devices and Protocols on VPN-Encrypted Networks
Talkington, J., Dantu, R., & Morozov, K. (2020) · International Conference on Mobile and Secure Services (MobiSecServ) · doi:10.1109/mobisecserv48690.2020.9042946 · Cited by 1
Machine Learning based Video Hosting Site Identification Method for MVNO Networks
Sawabe, A., Ito, T., & Iwai, T. (2020) · IEEE Consumer Communications and Networking Conference · doi:10.1109/ccnc46108.2020.9045105 · Cited by 1
“, protocol, source IP address, destination IP address, source port number, and destination port number) [5]–[8].”
BackgroundOnline Fast Detection and Diagnosis of Power Grid Security Attacks Using State Checksums
Banerjee, S., & Chatterjee, A. (2021) · IEEE International On-Line Testing Symposium (IOLTS) · doi:10.1109/iolts52814.2021.9486696 · Cited by 1
“Recent research has demonstrated disruptive capabilities of adversaries by snooping on encrypted data [1, 2] and corrupting system operation through malware [3, 4].”
BackgroundPrivacy-Preserving Access for Multi-Access Edge Computing (MEC) Applications
Akman, G., Ginzboorg, P., & Niemi, V. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-87010-2_4 · Cited by 1
Application Recognition Based on Bit-Stream Shape in Mobile Networks
Chmieliauskas, D., & Paulikas, Š. (2022) · IEEE Open Conference of Electrical, Electronic and Information Sciences (eStream) · doi:10.1109/estream56157.2022.9781681 · Cited by 1
Choo, E., Nabeel, M., AlSabah, M., Khalil, I. M., Yu, T., & Wang, W. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1911.12080 · Cited by 1
“Mobile users mostly access the contents through the apps in their devices [32].”
BackgroundMethodInfluentialDetecting Hidden Wireless Cameras through Network Traffic Analysis
Cowan, K. K. (2020) · VTechWorks (Virginia Tech) · Cited by 1
Bayat, M., Naghshbandi, Z., & Teimouri, M. (2025) · Preprints.org · doi:10.20944/preprints202504.0946.v1 · Cited by 1
Xie, T., Tu, G.-H., Yin, B., Li, C.-Y., Peng, C., Zhang, M., Liu, H., & Liu, X. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1811.11274
“Another work [53] demonstrates automatic fingerprinting and real-time identification of Android applications from their encrypted network traffic, which even could work when HTTPS/TLS is employed.”
BackgroundResearch on Multi-Operator Direct Payment for Public Operating Service Platform of Electric Vehicles
Wu, G., Chen, F., Chen, J., Lv, J., & Zhang, Y. (2018) · doi:10.1145/3148453.3306285
Análise de Vazamentos Temporais Side-Channel no Contexto da Internet das Coisas
Prates, N. G., Vergütz, A., Macedo, R., & Nogueira, M. (2019) · doi:10.5753/wgrs.2019.7690
“No entanto, estes estudos consideraram somente o tráfego web do protocolo HTTP. [Taylor et al. 2018] exploraram as informações sobre o tamanho e a direção dos pacotes por meio de vazamento side-channel a fim de identificar aplicativos móveis.”
BackgroundAnalysis Of Network Traffic For Identifying Vulnerabilities In Encrypted Smartphone Communications
Princeton, X. A., Livingston, J. J., Mohan, N., Ganesh, A., & Atheeswaran, M. (2020) · International journal of scientific and technology research
Mobile Social Service User Identification Framework Based on Action-Characteristic Data Retention
Li, C.-Y., Huang, C.-C., Lai, F., Lee, S., Wu, J., Chang, R., & Huang, H.-W. (2020) · IEEE Access · doi:10.1109/access.2020.3009010
Fingerprinting Search Keywords over HTTPS at ScalePreprint
Yan, J., Alan, H. F., & Kaur, J. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2008.08161 · Cited by 3
DSM: Delayed Signature Matching in Deep Packet Inspection
Zeng, Y., Guo, S., Wu, T., & Zheng, Q. (2020) · Symmetry · doi:10.3390/sym12122011
Efficient yet Robust Privacy Preservation for MPEG-DASH-Based Video Streaming
Cranfill, L., Kim, J., Lee, H.-K., Kemmoe, V. Y., Cho, S., & Son, J. (2021) · Security and Communication Networks · doi:10.1155/2021/4702469
Survey Paper on Secret Sharing Schema for Digital Quick Response Code Applications
Miss. Mugale Swati., M. (2021) · International Journal for Research in Applied Science and Engineering Technology · doi:10.22214/ijraset.2021.37023
Mobile Encrypted Traffic Classification Based on Message Type Inference
Chen, Y., Zang, T., Zhang, Y., Zhou, Y. J., & Yang, P. (2021) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-030-92635-9_8
Fine-grained identification of camera devices based on inherent features
Wang, R., Li, R., Dong, W., Zhang, Z., & Jiang, L. (2022) · Mathematical Biosciences & Engineering · doi:10.3934/mbe.2022173
2018 IndexIEEE Transactions on Information Forensics and SecurityVol. 13
(2018) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2018.2889124
BSBA: Burst Series Based Approach for Identifying Fake Free-traffic
Li, S., Liu, C., Li, Z., Yang, Q., Xu, A., & Gou, G. (2022) · IEEE International Symposium on a World of Wireless, Mobile and Multimedia Networks (WoWMoM) · doi:10.1109/wowmom54355.2022.00019
Service-Based Identification of Highly Coupled Mobile Applications
Wu, H., Wang, R., Cheng, G., & Hu, X. (2022) · Conference on Local Computer Networks · doi:10.1109/lcn53696.2022.9843423
“V.F. Taylor et al. [5] used statistical features to identify similar traffic among applications.”
BackgroundFine-Grained High-Utility Dynamic Fingerprinting Extraction for Network Traffic Analysis
Sun, X., Yi, J., Yang, F., & Liu, L. (2022) · Applied Sciences · doi:10.3390/app122211585
Encrypted 5G over-the-top voice traffic classification using deep learning
Qiao, Z., Zhang, S., Zhai, L., & Zhang, X. (2022) · ITU Journal on Future and Evolving Technologies · doi:10.52953/eyif3681
“[14] proposed a ingerprint scheme for Android applications with statistical characteristics of packet length, called AppScanner.”
BackgroundPrivate Protocol Traffic Identification Based on Sequence Statistical Fingerprint
Li, J., Cheng, G., Jing, Z., & Wei, H. (2022) · Globecom · doi:10.1109/globecom48099.2022.10000713
“[6] used the statistical packet length in different directions to extract fingerprints and combined reinforcement learning to reduce the influence of operating system in identification.”
MethodMAT-GT: An Automated Ground Truth Collection Tool for Mobile Application Traffic
Yang, Q., Zhang, J., Shi, J., Fu, P., & Xiong, G. (2022) · IEEE Conference on Telecommunications, Optics and Computer Science (TOCS) · doi:10.1109/tocs56154.2022.10016205
“Some research papers have shown that many mobile apps share the same third-party libraries, including advertising libraries, social networking services, crash analytics, and so on [3].”
BackgroundAoki, H., Ozu, T., Hasegawa, A., & Yokoyama, H. (2023) · IEICE Communications Express · doi:10.1587/comex.2023xbl0041
Identifying Mobile Application Over Shadowsocks with Single-Direction Traffic
Cui, S., Wang, D., Zhang, X., Zhang, M., & Guo, S. (2023) · IEEE International Conference on Data Science in Cyberspace · doi:10.1109/dsc59305.2023.00086
“Literature [9] uses enhanced machine learning to retrain the fuzzy flow, and the recognition accuracy rate is increased to 89.9%.”
BackgroundInfluentialVT-Scanner: Layout Similarity on Smartphone and Its Application for Robust Scene Recognition
Zhu, J., Wang, L., Xin, T., & Qin, X.-W. (2023) · International Conference on Wireless Communications and Signal Processing · doi:10.1109/wcsp58612.2023.10404697
Zhou, B., & Huang, Y. (2024) · IEEE Advanced Information Technology, Electronic and Automation Control Conference (IAEAC) · doi:10.1109/iaeac59436.2024.10503735
“FlowPrint [7] Statistical feature approached AppScanner[10], CUMUL[28], BIND[11], k-fingerprinting(K-fp)[30] Deep learning approaches Deep Fingerprinting(DF)[12],FS-Net[13], GraphDApp[31],TSCRNN[2],Deeppacket[14] Pre-training approaches PERT[21],ET-BERT(flow)[9],ET-BERT(packet)[9],BFCN[26],TSFN[27] We used three datas…”
MethodEncrypted Traffic Classification Based on Multi-Stage Neural Networks
刘, 亚. (2024) · Modeling and Simulation · doi:10.12677/mos.2024.133215
OLIViS: An OSINT-Based Lightweight Method for Identifying Video Services in Backbone ISPs
Tamura, Y., Teraoka, F., & Kondo, T. (2024) · IEEE/IFIP Network Operations and Management Symposium (NOMS) · doi:10.1109/noms59830.2024.10575803
“Given the presence of ambiguous flows (e.g., advertisements and Web-API traffic [38]), they propose a Neural Network model trained for the relationship between multiple flows adjacent to an ambiguous flow.”
BackgroundZhang, Y., Jia, Z.-H., Huang, X.-H., Wang, J.-J., Zhou, G., Shi, F., & Lu, C. (2024) · International Conference on Image Processing and Artificial Intelligence · doi:10.1117/12.3035287
RN-ETE: A Retentive Network-based Encryption Traffic Encoder
Qiu, Y., Liu, Y., & Zhang, S. (2024) · International Conference on Cryptography, Network Security and Communication Technology (CNSCT) · doi:10.1145/3673277.3673315
Li, S.-B., Lv, Z., Zang, T., Yang, L., & Qiang, Q. (2024) · IEEE International Joint Conference on Neural Network · doi:10.1109/ijcnn60899.2024.10650862
“In their subsequent research [4], they introduced reinforcement learning methods into AppScanner, which leads to a large performance improvement in reducing false positives.”
MethodCali-Net: Cross-Attention on Packet Lengths and Intervals for Encrypted Traffic Classification
Zhu, W., Cheng, G., & Qiu, X. (2024) · doi:10.1109/icsip61881.2024.10671541
Security Assessment of IoT Devices: A Contemporary Survey
Pathak, I., Indu, S., & Walia, G. S. (2024) · 2024 First International Conference on Electronics, Communication and Signal Processing (ICECSP) · doi:10.1109/icecsp61809.2024.10698275 · Cited by 1
“Vincent F. Taylor et al. [11] stated a mechanism which utilizes Machine Learning for app identification and extending AppScanner tool.”
BackgroundMethodA Method for Malicious Encrypted Traffic Classification Based on Contrastive Pre-Training
Shen, W., Cui, L., Zhou, Z., Wang, Y., & Jin, G. (2024) · International Conference on Electronic Engineering and Informatics (EEI) · doi:10.1109/eei63073.2024.10696063
Network Traffic Classification Based on Multilevel Spatiotemporal Feature Fusion Enhancement
Zhang, Y., Jia, Z.-H., Zhao, H., Lu, X.-Y., Shi, F., Zhou, G., & Wang, J.-J. (2024) · CAIBDA · doi:10.1145/3690407.3690459 · Cited by 2
Ma, M.-H., Shi, Z., Yin, Q., & Zong, Y. (2024) · International Symposium on Computers and Communications · doi:10.1109/iscc61673.2024.10733622
“3) Baselines and Evaluation Metrics: We selected several representative state-of-the-art methods as baselines, including: 1) Statistical-based methods: AppScanner [21] and FlowPrint [6].”
MethodET-SSM: Linear-Time Encrypted Traffic Classification Method Based On Structured State Space Model
Li, Y., Zhao, X., Zha, Z., & Ling, Z.-H. (2024) · Asia-Pacific Signal and Information Processing Association Annual Summit and Conference (APSIPA ASC) · doi:10.1109/apsipaasc63619.2025.10849155
A Study on Classification of Tor Encrypted Traffic Based on Mamba
Zhao, S., Tan, Q., Xiang, Y., & Tan, R. (2024) · IEEE Smart World Congress (SWC) · doi:10.1109/swc62898.2024.00356
ANT-ET: An end-to-end multimodal framework for fine-grained encrypted traffic fingerprinting
Kong, H., Yang, L., Ge, J., Li, T., & Li, H. (2025) · Journal of Computer Security · doi:10.1177/0926227x251325484
Enhanced Encrypted Traffic Classification Through Packet-Flow Dual Views
Feng, B., Wang, Q., Wang, Y.-J., Li, F., Xu, X., Zang, T., & Ma, J. (2025) · IEEE Wireless Communications and Networking Conference · doi:10.1109/wcnc61545.2025.10978498
REFS: a novel framework for accelerated receive encrypted flow steering
Ma, Z., Xin, Y., Hu, N., Li, T., Zhang, Z., & Zhang, F. (2025) · The Computer Journal · doi:10.1093/comjnl/bxaf059
BGETC: An Encrypted Traffic Classification Method Based on BERT and GRU
Yang, X., Luktarhan, N., Mei, Y., Meng, Y., & Zhao, G. (2025) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-031-89360-5_8
BTG-RF: Recognizing Douyin payment behaviors based on behavioral traffic graph analysis
Chen, Y., Hu, X., Chen, X., Cheng, G., Li, R., & Wu, H. (2025) · Computer Networks · doi:10.1016/j.comnet.2025.111385
Jibber-Jabber!: Encoding the (Un-)Natural Language of Network Devices and Applications
Bar-on, M., Krosky, K., Larrieu, F., Bezawada, B., Ray, I., & Ray, I. (2025) · Lecture notes in computer science · doi:10.1007/978-3-031-96590-6_1
Liu, Y. R., Sang, G., Li, B., Wang, T., & Wu, W. (2024) · International Conference on Mobility, Sensing and Networking (MSN) · doi:10.1109/msn63567.2024.00109
Secure access to network data for mobile network traffic analysis applications
Mvondo, D., & Bromberg, Y.-D. (2025) · International Conference on Dependable Systems & Networks/Proceedings · doi:10.1109/dsn64029.2025.00063
“However, SAN E M applications can easily perform fingerprinting from packet headers to correlate applications with network traces [2, 114, 121].”
FOADA: Toward Robust Open-World Mobile App Fingerprinting
Gong, J., Meng, G.-T., Cai, W., Liang, S., Wang, T., & Chang, E.-C. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3589008 · Cited by 1
“One of the major threats in this context is App Fingerprinting (AF) attacks, a type of tra ffi c analysis attack where an adversary infers which apps are used by analyzing encrypted network tra ffi c [3], [4], [5], [6], [7], [8], [9], [10], [11], [12], [13], [14], [15], [16].”
InfluentialZeeshan, M., Khan, M., Shah, A. A., & Tanzeel, C. (2025) · International Conference on Innovation in Artificial Intelligence and Internet of Things (AIIT) · doi:10.1109/aiit63112.2025.11082887
“This approach enables the model to generalize effectively on unseen sequences. h) Output Layer: This is also a Dense layer with 11 units to match the 11 high precision and recall classes ([1,8,11,12,15,16,17,18,20,26,27]).”
Generalized Encrypted Traffic Classification Using Inter-flow Signals
Bianchi, F., Paolo, E. D., & Spognardi, A. (2025) · ARES · doi:10.1007/978-3-032-00624-0_11
“Taylor et al. in AppScanner [24] adopted machine learning models using statistical features at the intra-flow level and packet sizes to recognize apps.”
Traffic Analysis and Recognition in Data Insufficient Scenarios
Huang, S., Xie, X., Xu, R., Li, C., Zhang, Y., Wang, M., Zhang, L., & Cui, Y. (2025) · doi:10.1145/3748496.3748992
“To overcome the limitations of rule-based methods, several statistical methods have been proposed to identify applications based on statistical features extracted from tra ! c [1, 7, 11, 26].”
InfluentialRobust Network Intrusion Detection via Semi-supervised Deep Reinforcement Learning
Spolaor, R., Chen, T., Hu, P., & Cheng, X. (2025) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-031-94455-0_9
Self-citationZheng, C., Ma, H., Qu, Y., Jiang, Y., & Wang, W. (2025) · SSRN Electronic Journal · doi:10.2139/ssrn.5492119
Collaborative Countermeasure Against Network Traffic Analyses Based on Packet Aggregation
Spolaor, R., Shi, H., Gaspari, F. D., Mancini, L. V., Yu, D., & Cheng, X.-Z. (2025) · ICC 2025 - IEEE International Conference on Communications · doi:10.1109/icc52391.2025.11160961
“NTA has been leveraged to infer traffic characteristics [6], operating system and browser used by the communication endpoints [7], installed mobile applications [8], [9], user actions [10], [11], and browsed websites [12].”
Self-citationKuang, B., Chen, Y., Gao, Y., Xu, Y., Fu, A., & Susilo, W. (2025) · Computer Communications · doi:10.1016/j.comcom.2025.108333
Yin, J., Cui, L., Hao, Z., Sun, J., Liu, P., & Yun, X. (2025) · IEEE International Conference on Network Protocols (ICNP) · doi:10.1109/icnp65844.2025.11192383
Deng, X., Zhao, R., Zhan, M., Wu, S., Wang, Y., & Xue, Z. (2025) · Lecture notes in computer science · doi:10.1007/978-981-95-3537-8_26
Li, Z., Si, C.-X., & Cheng, Z. (2025) · ACM Multimedia · doi:10.1145/3746027.3755615
“Taylor et al. [43] optimized the traffic features by mixing automatic and manual feature extraction.”
GSC-SAGE: A Generative Subgraph Contrastive Framework for Encrypted Traffic Detection
Cheng, H., Chen, W.-H. C., Yan, Z., Jiang, W., Zhu, D., & Yin, L. (2025) · Lecture notes in computer science · doi:10.1007/978-981-95-3001-4_26
Ma, Y., Cao, X., Yang, H., Zhong-peng, Y., & Su, H. Y. (2025) · International Conference on Optics, Electronics, and Communication Engineering (OECE) · doi:10.1117/12.3091005
HFE-Traffic: Frequency-Oriented Encrypted Traffic Classification with Mamba State Space Models
Liu, S., Yang, J., Wei, X., Fan, Z., An, B., Guo, L., & Zeng, F. (2025) · International Conference on Artificial Intelligence and Computer Information Technology (AICIT) · doi:10.1109/aicit65974.2025.11282778
Bayat, M., Garshasbi, J., Mehdizadeh, M., Nozari, N., Khesal, A. R., Dokhaei, M., & Teimouri, M. (2024) · Figshare · doi:10.6084/m9.figshare.26045526
Knowledge-Enhanced Zero-Shot Graph Learning-Based Mobile Application Identification
Zhang, D., Huang, J., Tian, M., & Guan, L. (2025) · Electronics · doi:10.3390/electronics15010126
An Efficient Encrypted Traffic Classification Method Using Mamba Architecture with MHSA Frontend
Fan, R.-P., & Wang, W. (2025) · 2025 6th International Conference on Computer Engineering and Intelligent Control (ICCEIC) · doi:10.1109/icceic67916.2025.11309076
Zhang, Y., Wang, S., Chen, Z., & Yang, B. (2026) · Journal of Network and Systems Management · doi:10.1007/s10922-025-10011-8
“In early research, Taylor et al. [15] proposed AppScanner, which constructs finger - prints by clustering statistical features of packet sizes, and then combines support vector machine (SVM) and random forest (RF) for classification.”
Hybrid-Net: A Multimodal Deep Learning Framework for Anonymous Traffic Classification
He, Y. C., Zhong, Y., & Hu, N. (2025) · IEEE International Conference on Data Science in Cyberspace · doi:10.1109/dsc67331.2025.00035
GVTMC: A Novel Cryptocurrency Mining Traffic Classification Method
Lai, Y., Liu, H., & Zhang, W. (2025) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom66490.2025.00323
ET-FS: Functional Specialization Method for Multi-Task Learning in Encrypted Traffic Classification
Feng, X., Gou, G., Liu, C., Gu, Z., Dong, W., He, F., & Wang, X. (2025) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom66490.2025.00088
GranulNet: A unified framework for traffic identification using multi-grained feature fusion
Qin, J., Han, X.-Y., Li, Y., Wang, D., Cui, S., Jiang, B., Lu, Z.-G., & Liu, B.-X. (2026) · Comput. Networks · doi:10.1016/j.comnet.2026.112120 · Cited by 1
Interpretable Feature Engineering for Robust Mobile Application Traffic ClassificationPreprint
Khesal, A. R., & Teimouri, M. (2026) · SSRN Electronic Journal · doi:10.2139/ssrn.6293191
Metadata
- Authors
- Taylor, V. F., Spolaor, R., Conti, M., & Martinovic, I.
- Affiliations
- University of Oxford (GB)
- University of Padua (IT)
- Venue
- IEEE Transactions on Information Forensics and Security
- Published
- 2018-01
- Volume
- 13
- Issue
- 1
- Pages
- 63-78
- ISSN
- 1556-6013 (ISSN-L)
- 1556-6021
- OpenAlex
- W2609737443
- Cited by
- 439
- References
- 30
- Citations by year
- 2026: 47 · 2025: 69 · 2024: 63 · 2023: 55 · 2022: 60 · 2021: 45 · 2020: 41 · 2019: 39 · 2018: 18
- FWCI
- 16.15
- Type
- journal article
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- IEEE Transactions on Information Forensics and Security (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- Padua Research Archive (University of Padova) (submittedVersion, other-oa)
- arXiv (Cornell University)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Physical Sciences › Computer Science › Information Systems › Digital and Cyber Forensics
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Keywords
- encrypted traffic analysis, packet size, SSL/TLS, passive eavesdropping, privacy leakage
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
