The DOI matches its Crossref record, with a small difference in title or year; 30 of the 30 references it cites were found in a registry or an index.
Robust Smartphone App Identification via Encrypted Network Traffic Analysis
Open accessAbstract
The apps installed on a smartphone can reveal much information about a user, such as their medical conditions, sexual orientation, or religious beliefs. In addition, the presence or absence of particular apps on a smartphone can inform an adversary, who is intent on attacking the device. In this paper, we show that a passive eavesdropper can feasibly identify smartphone apps by fingerprinting the network traffic that they send. Although SSL/TLS hides the payload of packets, side-channel data, such as packet size and direction is still leaked from encrypted connections. We use machine learning techniques to identify smartphone apps from this side-channel data. In addition to merely fingerprinting and identifying smartphone apps, we investigate how app fingerprints change over time, across devices, and across different versions of apps. In addition, we introduce strategies that enable our app classification system to identify and mitigate the effect of ambiguous traffic, i.e., traffic in common among apps, such as advertisement traffic. We fully implemented a framework to fingerprint apps and ran a thorough set of experiments to assess its performance. We fingerprinted 110 of the most popular apps in the Google Play Store and were able to identify them six months later with up to 96% accuracy. Additionally, we show that app fingerprints persist to varying extents across devices and app versions.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“These methods highly rely on expert-designed features and have limited generalization ability.”
From ET-BERT: A Contextualized Datagram Representation with Pre-training Transformers for Encrypted Traffic Classification (2022) · cites this paper as [36]
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Data Structures for Statistical Computing in Python
McKinney, W. (2010) · Proceedings of the Python in Science Conferences · doi:10.25080/majora-92bf1922-00a · Cited by 12,930 · cited 1×
“These statistical features are computed using the Python pandas [32] library.”
MethodAPI design for machine learning software: experiences from the scikit-learn projectPreprint
Buitinck, L., Louppe, G., Blondel, M., Pedregosa, F., Mueller, A., Grisel, O., Niculae, V., Prettenhofer, P., Gramfort, A., Grobler, J., et al. (2013) · arXiv (Cornell University) · doi:10.48550/arxiv.1309.0238 · Cited by 2,387 · cited 1×
“We leveraged the scikit-learn [34] machine learning libraries to implement the classifiers in our framework.”
MethodA survey of techniques for internet traffic classification using machine learning
Nguyen, T. T. T., & Armitage, G. (2008) · IEEE Communications Surveys & Tutorials · doi:10.1109/surv.2008.080406 · Cited by 1,664 · cited 1×
“Network traffic fingerprinting is not a new area of research, and indeed the literature exemplifies techniques for network traffic classification on traditional computers [7].”
BackgroundDynodroid: an input generation system for Android apps
Machiry, A., Tahiliani, R., & Naik, M. (2013) · ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) · doi:10.1145/2491411.2491450 · Cited by 702
Website Fingerprinting at Internet Scale
Panchenko, A., Lanze, F., Zinnen, A., Henze, M., Pennekamp, J., Wehrle, K., & Engel, T. (2016) · Proceedings 2016 Network and Distributed System Security Symposium · doi:10.14722/ndss.2016.23477 · Cited by 645 · cited 1×
“[17] present a website fingerprinting attack on Tor that outperforms related”
BackgroundWebsite fingerprinting in onion routing based anonymization networks
Panchenko, A., Niessen, L., Zinnen, A., & Engel, T. (2011) · ACM Workshop on Privacy in the Electronic Society (WPES) · doi:10.1145/2046556.2046570 · Cited by 531 · cited 1×
“Similar work was proposed by Panchenko et al. [18].”
MethodPeek-a-Boo, I Still See You: Why Efficient Traffic Analysis Countermeasures Fail
Dyer, K. P., Coull, S. E., Ristenpart, T., & Shrimpton, T. (2012) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2012.28 · Cited by 478 · cited 3×
“[16] presented web-page fingerprinting attacks and discussed their effectiveness despite traffic analysis countermeasures (e.”
BackgroundMethodInfluentialA first look at traffic on smartphones
Falaki, H., Lymberopoulos, D., Mahajan, R., Kandula, S., & Estrin, D. (2010) · ACM/SIGCOMM Internet Measurement Conference · doi:10.1145/1879141.1879176 · Cited by 453
Herrmann, D., Wendolsky, R., & Federrath, H. (2009) · doi:10.1145/1655008.1655013 · Cited by 423 · cited 1×
“Subsequently, Herman et al. [17] outperformed Liberatore et al. by presenting a method that relies on common text mining techniques to the normalized frequency distribution of observable IP packet sizes.”
MethodTraffic Analysis: Protocols, Attacks, Design Issues, and Open Problems
Raymond, J.-F. (2001) · Lecture notes in computer science · doi:10.1007/3-540-44702-4_2 · Cited by 422 · cited 1×
“With the advent of CDNs and standard web service APIs, more apps are sending their traffic to similar endpoints, and this frustrates attempts to fingerprint app traffic based on destination IP address only.”
Background
Research works printed but not linked: 5
- software, 2014, Network Log
- bacic, 2015, Are You Using A Content Delivery Network For Your Website Yet? You Should Be
- muehlstein, 2016, Analyzing HTTPS encrypted traffic to identify user operating system browser and application
- miller, 2014, I Know Why You Went to the Clinic Risks and Realization of HTTPS Traffic Analysis, 143
- stöber, 2013, Who do you sync you are?: Smartphone fingerprinting via application behaviour, Proc 6th ACM Conf Secur Privacy Wirel Mobile Netw (WiSec), 7
Cited by
Sorted by citations
Items 401–439 of 439
Using Emerging Technologies in Mobile Apps to Maximize Performance an in-depth Study
Joshi, B. P., Chilluri, V. S. B., & Tripathi, N. (2025) · Modern Electronics Devices and Intelligent Communication Systems (MEDCOM) · doi:10.1109/medcom67532.2025.11405374
Lu, J., Yu, K., Huang, Y., Wei, Z., Yin, J., & Liu, X. (2026) · IEEE Internet of Things Journal · doi:10.1109/jiot.2026.3670664
Zhao, L., Wu, C., & Yu, A. (2026) · IEEE Transactions on Networking · doi:10.1109/ton.2026.3674624 · Cited by 1
Interpretable Feature Engineering for Robust Mobile Application Traffic ClassificationPreprint
Khesal, A. R., & Teimouri, M. (2026) · SSRN Electronic Journal · doi:10.2139/ssrn.6470920
Enhancing Network Traffic Analysis with a Unique Imbalanced Data Algorithm in Deep Learning
Ashwini, P., Potlakayala, D., Aelgani, V., Sridhar, R., Karthick, K., & Priya, V. (2025) · International Conference on Recent Trends in Electrical, Electronics and Computing Technologies (ICRTEECT) · doi:10.1109/icrteect67512.2025.11448661
“Algorithms demonstrate better accuracy when training dataset sizes become larger [15].”
Khesal, A. R., Abed, M., Mohammadi, M. M., Mahdavirad, M. M., Kabiri, R., & Teimouri, M. (2026) · Data in Brief · doi:10.1016/j.dib.2026.112731
Guan, Z., & Liu, W. (2025) · International Conference on Cyber Resilience and Endogenous Safety & Security (CRESS) · doi:10.1109/cress68073.2025.11452476
Analyse de trafic HTTPS pour la supervision d'activités utilisateurs
Brissaud, P.-O. (2020) · theses.fr (ABES) · doi:10.70675/2dc00879z19eez4498za572z28e37697ded4
Encrypted Traffic Detection via a Federated Learning-Based Multi-Scale Feature Fusion Framework
Fei, Y., Zhao, Y., Liu, W., Wu, F., Liu, S., Zhu, X., Ji, Y., & Jia, P. (2026) · Electronics · doi:10.3390/electronics15081570
“Furthermore, most of these methods rely on a single type of feature modeling, such as statistical or temporal features [29–32], and thus fail to fully exploit the multi-dimensional characteristics of network traffic.”
PaT: An enhanced pretrained framework via Mamba-2 for network traffic analysis
Song, Z.-J., Ma, Z.-Y., Yu, Q.-M., Xie, X., Wang, Y.-L., & Yang, G.-Z. (2026) · Comput. Networks · doi:10.1016/j.comnet.2026.112307 · Cited by 1
NT-Transformer: A Non-Pretrained Encrypted Network Traffic Classification Model
Yan, Z., Peng, L., Liu, P., Bao, Y., & Yang, B. (2026) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2026.3683410
Quantum-Inspired Autoencoder and LSTM Model for Encrypted Traffic Anomaly Detection
Bompally, S. D. (2026) · International Conference on Artificial Intelligence, Computer, Data Sciences and Applications (ACDSA) · doi:10.1109/acdsa67686.2026.11468129
Echo-Traffic: Cross-Modal Feature Augmentation for Traffic Transformer Pre-Training
Feng, X., Gou, G., Dong, W., Jiang, X., Ding, Y., & Wang, X. (2026) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp55912.2026.11461226
Qiu, X., Cheng, G., Zhu, W., Niu, D., & Zhao, R. (2026) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp55912.2026.11461639
MagGuard: Detecting Mobile Eavesdropping via Built-In Magnetometers With Contrastive Learning
Pan, H., Yang, L., Fu, Y., Chen, Y.-C., Xue, G., & Ren, J. (2026) · IEEE Transactions on Mobile Computing · doi:10.1109/tmc.2026.3697471
“In [63], [64], the authors designed learning systems to automatically fingerprint apps using encrypted network traffic.”
SRViT: A Robust Online Encrypted Traffic Classification Based on Vision Transformer
Liu, C., Han, L., Diao, Z.-L., Wu, Z., He, X., Fan, W.-B., & Xiao, F. (2026) · IEEE Transactions on Networking · doi:10.1109/ton.2026.3699540
“Some studies [14], [15], [16], [17], [18] combine machine learning algorithms with statistical features manually extracted from raw tra ffi c to handle encrypted tra ffi c.”
Wang, Y., Sun, D., Wan, W., Zhao, J., Du, G., & Long, C. (2026) · Computer Networks · doi:10.1016/j.comnet.2026.112477
TCBI: A Three-Channel Behavioral Image-Based Method for encrypted malicious traffic detection
Li, H., Pan, Y., Tan, C., Liang, X., Gao, Z., Li, X., Li, Q., & Wang, H. (2026) · High-Confidence Computing · doi:10.1016/j.hcc.2026.100416
AirCloak: An App-Transparent Traffic Cloaking Middleware Against Wireless Fingerprinting Attack
Bian, H.-F., Li, J.-F., Luo, H., Liu, Y., Ma, X.-B., Li, Z., Zhang, J.-L., Wang, J.-G., & Wang, W. (2026) · IEEE Transactions on Networking · doi:10.1109/ton.2026.3705510
Zero-Recollecting Mobile-App Identification over Drifted Encrypted Network Traffic
Jiang, M., Ye, K., Cai, W., & Zhou, X. (2026) · Lecture notes in computer science · doi:10.1007/978-981-95-9284-5_13
DWTN: Need-Driven Presence Detection for Multiplexed Encrypted Traffic
Liu, L., Wei, Z.-L., Xie, W., Wen, L., Chen, Y., Wang, P., Chen, R., & Chen, S. (2026) · 2026 ICEENG International Conference for Innovations in Intelligent Computing and Cybersecurity (IICC) · doi:10.1109/iicc69623.2026.11582017
PCT-DBiC: A Session-Level Encrypted Traffic Classification Framework Based on Deep Learning
Song, Y., Chai, W., Liu, Y., Liu, Y., Zhang, P., & Liu, Z. (2026) · International Conference on Computer Supported Cooperative Work in Design (CSCWD) · doi:10.1109/cscwd68734.2026.11582421
Zhang, X., Qin, J., Wang, Y., Gao, K., Yang, X., Jiang, B., & Lu, Z. (2026) · International Conference on Computer Supported Cooperative Work in Design (CSCWD) · doi:10.1109/cscwd68734.2026.11582672
FlowMamba: A Memory-Decaying State Space Model for Stealthy Attack Detection
Yang, J., Liu, S., Cui, S., Liu, Y., Cui, Z., Jiang, B., Lu, Z., & Feng, H. (2026) · International Conference on Computer Supported Cooperative Work in Design (CSCWD) · doi:10.1109/cscwd68734.2026.11582249
Tan, Y., Liu, M., Li, Z., Li, H., Zhu, Y., & Shi, J. (2026) · International Conference on Computer Supported Cooperative Work in Design (CSCWD) · doi:10.1109/cscwd68734.2026.11581506
“The general traffic clas-sification models include APPSCANNER [17], BIND [18], and CUMUL [19], all trained on packet size sequences or packet timing sequences; in this study, they are applied to the binary classification task distinguishing direct connections from SIPS proxy traffic.”
Wang, Y., Sun, D., Du, G., Wan, W., Zhao, J., & Long, C. (2026) · Lecture notes in computer science · doi:10.1007/978-981-92-2859-1_33
Wei, J., Huang, Z., Wan, W., Lu, Y., Mu, Z., & Long, C. (2026) · Communications in computer and information science · doi:10.1007/978-981-92-3541-4_22
Luo, X., Yan, G., Yin, L.-H., Hou, G.-P., Guo, J., Song, Y., Li, X., Wang, W.-T., & Zhu, T.-Q. (2026) · Information Fusion · doi:10.1016/j.inffus.2026.104611
ST-Mamba: Spatio-Temporal Feature-Based Encrypted Traffic Analysis Using Mamba Network
Zhu, J., Fan, M., Cao, R., Zuo, J., Lu, Y., & Zou, S. (2026) · Lecture notes in computer science · doi:10.1007/978-981-92-3012-9_14
The attention leak: Behavioral inference from temporal metadata in network traffic
Donaire, A., Borrego, C., & Juarez, M. (2026) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2026.104560
Qu, Y., Zheng, C., Liao, M., Ma, H., Jiang, Y., & Wang, W. (2026) · Cybersecurity · doi:10.1186/s42400-026-00635-x
“…crafted by experts, combined with traditional machine learning algorithms such as Decision Trees (DT), Random Forests (RF), Support Vector Machines (SVM), Naive Bayes (NB), and K-Nearest Neighbors (KNN) to identify malicious traffic (Moore and Zuev 2005; Bernaille et al. 2006; Taylor et al. 2017).”
Enhancing Encrypted Traffic Detection for Social Networks With Inter-Packet Contextual Association
Zhao, X., He, M., Wang, X., & Guo, S. (2026) · IEEE Transactions on Computational Social Systems · doi:10.1109/tcss.2026.3714853
HeraClass: Towards Open-World Network Flow Classification via Traffic-Language Mapping
Jin, N., Liu, L., Miao, Y., Chen, L., Li, D., Wang, X., Xu, X., & Cui, B. (2026) · International Workshop on Quality of Service · doi:10.1109/iwqos70441.2026.11661238
TrafficMoE: LLM-based mixture-of-experts framework for multi-task network traffic classification
Chen, H., Gao, D., Zhang, W., Yang, L., & Zhou, Z. (2026) · Journal of King Saud University - Computer and Information Sciences · doi:10.1007/s44443-026-01202-7
Zion, Y., Dvir, A. Z., Hajaj, C., Dubin, R., & Filber, N. (2026) · Computer Networks · doi:10.1016/j.comnet.2026.112739
Feng, Y., Meng, J., Hong, Y., Yang, Y., Guo, F., Zhu, H., & Yang, Z. (2026) · Lecture notes in computer science · doi:10.1007/978-981-92-6857-3_29
Interpretable Flow-Based Classification of Instant Messaging Applications Using TabNet
Mondal, R., Yadav, S., & Likhar, P. (2026) · Lecture notes in networks and systems · doi:10.1007/978-3-032-29322-0_15
Lv, H., 谭开忠, Wang, S., Mo, Z., & Ding, Y. (2026) · Journal of Systems Architecture · doi:10.1016/j.sysarc.2026.104046
Metadata
- Authors
- Taylor, V. F., Spolaor, R., Conti, M., & Martinovic, I.
- Affiliations
- University of Oxford (GB)
- University of Padua (IT)
- Venue
- IEEE Transactions on Information Forensics and Security
- Published
- 2018-01
- Volume
- 13
- Issue
- 1
- Pages
- 63-78
- ISSN
- 1556-6013 (ISSN-L)
- 1556-6021
- OpenAlex
- W2609737443
- Cited by
- 439
- References
- 30
- Citations by year
- 2026: 47 · 2025: 69 · 2024: 63 · 2023: 55 · 2022: 60 · 2021: 45 · 2020: 41 · 2019: 39 · 2018: 18
- FWCI
- 16.15
- Type
- journal article
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- IEEE Transactions on Information Forensics and Security (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- Padua Research Archive (University of Padova) (submittedVersion, other-oa)
- arXiv (Cornell University)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Physical Sciences › Computer Science › Information Systems › Digital and Cyber Forensics
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Keywords
- encrypted traffic analysis, packet size, SSL/TLS, passive eavesdropping, privacy leakage
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
