The DOI matches its Crossref record, with a small difference in title or year; 30 of the 30 references it cites were found in a registry or an index.
Robust Smartphone App Identification via Encrypted Network Traffic Analysis
Open accessAbstract
The apps installed on a smartphone can reveal much information about a user, such as their medical conditions, sexual orientation, or religious beliefs. In addition, the presence or absence of particular apps on a smartphone can inform an adversary, who is intent on attacking the device. In this paper, we show that a passive eavesdropper can feasibly identify smartphone apps by fingerprinting the network traffic that they send. Although SSL/TLS hides the payload of packets, side-channel data, such as packet size and direction is still leaked from encrypted connections. We use machine learning techniques to identify smartphone apps from this side-channel data. In addition to merely fingerprinting and identifying smartphone apps, we investigate how app fingerprints change over time, across devices, and across different versions of apps. In addition, we introduce strategies that enable our app classification system to identify and mitigate the effect of ambiguous traffic, i.e., traffic in common among apps, such as advertisement traffic. We fully implemented a framework to fingerprint apps and ran a thorough set of experiments to assess its performance. We fingerprinted 110 of the most popular apps in the Google Play Store and were able to identify them six months later with up to 96% accuracy. Additionally, we show that app fingerprints persist to varying extents across devices and app versions.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“These methods highly rely on expert-designed features and have limited generalization ability.”
From ET-BERT: A Contextualized Datagram Representation with Pre-training Transformers for Encrypted Traffic Classification (2022) · cites this paper as [36]
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Data Structures for Statistical Computing in Python
McKinney, W. (2010) · Proceedings of the Python in Science Conferences · doi:10.25080/majora-92bf1922-00a · Cited by 12,930 · cited 1×
“These statistical features are computed using the Python pandas [32] library.”
MethodAPI design for machine learning software: experiences from the scikit-learn projectPreprint
Buitinck, L., Louppe, G., Blondel, M., Pedregosa, F., Mueller, A., Grisel, O., Niculae, V., Prettenhofer, P., Gramfort, A., Grobler, J., et al. (2013) · arXiv (Cornell University) · doi:10.48550/arxiv.1309.0238 · Cited by 2,387 · cited 1×
“We leveraged the scikit-learn [34] machine learning libraries to implement the classifiers in our framework.”
MethodA survey of techniques for internet traffic classification using machine learning
Nguyen, T. T. T., & Armitage, G. (2008) · IEEE Communications Surveys & Tutorials · doi:10.1109/surv.2008.080406 · Cited by 1,664 · cited 1×
“Network traffic fingerprinting is not a new area of research, and indeed the literature exemplifies techniques for network traffic classification on traditional computers [7].”
BackgroundDynodroid: an input generation system for Android apps
Machiry, A., Tahiliani, R., & Naik, M. (2013) · ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) · doi:10.1145/2491411.2491450 · Cited by 702
Website Fingerprinting at Internet Scale
Panchenko, A., Lanze, F., Zinnen, A., Henze, M., Pennekamp, J., Wehrle, K., & Engel, T. (2016) · Proceedings 2016 Network and Distributed System Security Symposium · doi:10.14722/ndss.2016.23477 · Cited by 645 · cited 1×
“[17] present a website fingerprinting attack on Tor that outperforms related”
BackgroundWebsite fingerprinting in onion routing based anonymization networks
Panchenko, A., Niessen, L., Zinnen, A., & Engel, T. (2011) · ACM Workshop on Privacy in the Electronic Society (WPES) · doi:10.1145/2046556.2046570 · Cited by 531 · cited 1×
“Similar work was proposed by Panchenko et al. [18].”
MethodPeek-a-Boo, I Still See You: Why Efficient Traffic Analysis Countermeasures Fail
Dyer, K. P., Coull, S. E., Ristenpart, T., & Shrimpton, T. (2012) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2012.28 · Cited by 478 · cited 3×
“[16] presented web-page fingerprinting attacks and discussed their effectiveness despite traffic analysis countermeasures (e.”
BackgroundMethodInfluentialA first look at traffic on smartphones
Falaki, H., Lymberopoulos, D., Mahajan, R., Kandula, S., & Estrin, D. (2010) · ACM/SIGCOMM Internet Measurement Conference · doi:10.1145/1879141.1879176 · Cited by 453
Herrmann, D., Wendolsky, R., & Federrath, H. (2009) · doi:10.1145/1655008.1655013 · Cited by 423 · cited 1×
“Subsequently, Herman et al. [17] outperformed Liberatore et al. by presenting a method that relies on common text mining techniques to the normalized frequency distribution of observable IP packet sizes.”
MethodTraffic Analysis: Protocols, Attacks, Design Issues, and Open Problems
Raymond, J.-F. (2001) · Lecture notes in computer science · doi:10.1007/3-540-44702-4_2 · Cited by 422 · cited 1×
“With the advent of CDNs and standard web service APIs, more apps are sending their traffic to similar endpoints, and this frustrates attempts to fingerprint app traffic based on destination IP address only.”
BackgroundInferring the source of encrypted HTTP connections
Liberatore, M., & Levine, B. N. (2006) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/1180405.1180437 · Cited by 421 · cited 2×
“[13] outperformed the aforementioned work by Liberatore and Levine [12] by presenting a method that relies on common text mining techniques performed over the normalized frequency distribution of observable IP packet sizes.”
BackgroundMethodAppScanner: Automatic Fingerprinting of Smartphone Apps from Encrypted Network Traffic
Taylor, V. F., Spolaor, R., Conti, M., & Martinović, I. (2016) · IEEE European Symposium on Security and Privacy · doi:10.1109/eurosp.2016.40 · Cited by 420 · cited 3×
“In this paper we extend AppScanner, first presented by the authors in [8], along several important dimensions.”
BackgroundMethodInfluentialSelf-citationCai, X., Zhang, X. C., Joshi, B., & Johnson, R. (2012) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/2382196.2382260 · Cited by 394 · cited 1×
“More recently, Cai et al. [19] presented a web page fingerprinting attack and showed its effectiveness despite traffic analysis countermeasures (e.g., HTTPOS).”
BackgroundFingerprinting Websites Using Traffic Analysis
Hintz, A. S. (2003) · Lecture notes in computer science · doi:10.1007/3-540-36467-6_13 · Cited by 291 · cited 1×
“Much work has been done on analysing traffic from work-stations and web browsers [9].”
BackgroundAnalyzing Android Encrypted Network Traffic to Identify User Actions
Conti, M., Mancini, L., Spolaor, R., & Verde, N. V. (2016) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2015.2478741 · Cited by 275 · cited 1×
“[28] and Saltaformaggio et al.”
Self-citationIndependent comparison of popular DPI tools for traffic classification
Bujlow, T., Carela-Español, V., & Barlet‐Ros, P. (2014) · Computer Networks · doi:10.1016/j.comnet.2014.11.001 · Cited by 245 · cited 1×
“[9] do an independent comparison of traffic”
NetworkProfiler: Towards automatic fingerprinting of Android apps
Dai, S., Tongaonkar, A., Wang, X.-Y., Nucci, A., & Song, D. (2013) · 2013 Proceedings IEEE INFOCOM · doi:10.1109/infcom.2013.6566868 · Cited by 201 · cited 1×
“[20] propose NetworkProfiler, an automated approach to profiling and identifying Android apps using dynamic methods.”
MethodPredicting user traits from a snapshot of apps installed on a smartphone
Seneviratne, S., Seneviratne, A. P., Mohapatra, P., & Mahanti, A. (2014) · ACM SIGMOBILE Mobile Computing and Communications Review · doi:10.1145/2636242.2636244 · Cited by 150 · cited 1×
“As a result, the apps installed on typical smartphones may reveal sensitive information about a user’s medical conditions, hobbies, and sexual/religious preferences [6].”
BackgroundQazi, Z. A., Lee, J., Jin, T., Bellala, G., Arndt, M., & Noubir, G. (2013) · ACM SIGCOMM Conference (SIGCOMM) · doi:10.1145/2486001.2491700 · Cited by 147 · cited 1×
“[21] present Atlas, a framework for identifying apps using network flows.”
MethodI know what you did on your smartphone: Inferring app usage over encrypted data traffic
Wang, Q., Yahyavi, A., Kemme, B., & He, W. (2015) · IEEE Conference on Communications and Network Security · doi:10.1109/cns.2015.7346855 · Cited by 111 · cited 1×
“Wanget al. [22] propose a system for identifying smart-phone apps from encrypted 802.11 frames.”
BackgroundInfluentialCan Android Applications Be Identified Using Only TCP/IP Headers of Their Launch Time Traffic?
Alan, H. F., & Kaur, J. (2016) · Wireless Network Security · doi:10.1145/2939918.2939929 · Cited by 90 · cited 1×
“Alan and Kaur [26] use TCP/IP headers for identifying apps.”
BackgroundA Web Traffic Analysis Attack Using Only Timing Information
Feghhi, S., & Leith, D. J. (2016) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2016.2551203 · Cited by 84 · cited 1×
“…are some similarities, such as end-to-end communication using IP addresses/ports, there are nuances in the type of traffic sent by smartphones and the way in which it is sent that makes traffic analysis in the realm of smartphones distinct from traffic analysis on traditional workstations [10]–[13].”
BackgroundEavesdropping on fine-grained user activities within smartphone apps over encrypted network traffic
Saltaformaggio, B., Choi, H., Johnson, K., Kwon, Y., Zhang, Q., Zhang, X., Xu, D., & Qian, J. (2016) · Cited by 81
Le, A., Varmarken, J., Langhoff, S., Shuba, A., Gjoka, M., & Markopoulou, A. P. (2015) · doi:10.1145/2787394.2787396 · Cited by 79 · cited 1×
“[22] propose AntMonitor, a system that also uses crowdsourcing but for the fine-grained collection of network data from Android devices.”
BackgroundTaylor, V. F., & Martinović, I. (2017) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3052973.3052990 · Cited by 50 · cited 1×
“set of apps and identifying new versions of the same apps incurred a further performance penalty. This phenomenon is not unexpected, since apps routinely receive changes to their logic during updates [30], which may cause changes in their network traffic flows. However, our classification system shows that it is able to…”
BackgroundSelf-citationA study on Smart-phone traffic analysis
Lee, S., Park, J., Lee, H.-S., & Kim, M. (2011) · Asia-Pacific Network Operations and Management Symposium (APNOMS) · doi:10.1109/apnoms.2011.6077033 · Cited by 28
Enhancing the Performance of Mobile Traffic Identification with Communication Patterns
Mongkolluksamee, S., Visoottiviseth, V., & Fukuda, K. (2015) · IEEE Annual International Computer Software and Applications Conference (COMPSAC) · doi:10.1109/compsac.2015.50 · Cited by 18 · cited 1×
“[24] [25] use packet size distribution and communication patterns for identifying mobile app traffic.”
BackgroundMongkolluksamee, S., Visoottiviseth, V., & Fukuda, K. (2016) · Journal of Information Processing · doi:10.2197/ipsjjip.24.247 · Cited by 14 · cited 1×
“[24] [25] use packet size distribution and communication patterns for identifying mobile app traffic.”
BackgroundAnalysis of smartphone traffic with MapReduce
Yang, J., Zhang, S., Zhang, X., Liu, J., & Cheng, G. (2013) · Wireless and Optical Communications Conference · doi:10.1109/wocc.2013.6676399 · Cited by 5
Applicaion-level traffic analysis of smartphone users using embedded agents
Ham, H.-S., & Choi, M.-J. (2012) · Asia-Pacific Network Operations and Management Symposium (APNOMS) · doi:10.1109/apnoms.2012.6356057 · Cited by 4 · cited 1×
“…are some similarities, such as end-to-end communication using IP addresses/ports, there are nuances in the type of traffic sent by smartphones and the way in which it is sent that makes traffic analysis in the realm of smartphones distinct from traffic analysis on traditional workstations [10]–[13].”
Background
Research works printed but not linked: 5
- software, 2014, Network Log
- bacic, 2015, Are You Using A Content Delivery Network For Your Website Yet? You Should Be
- muehlstein, 2016, Analyzing HTTPS encrypted traffic to identify user operating system browser and application
- miller, 2014, I Know Why You Went to the Clinic Risks and Realization of HTTPS Traffic Analysis, 143
- stöber, 2013, Who do you sync you are?: Smartphone fingerprinting via application behaviour, Proc 6th ACM Conf Secur Privacy Wirel Mobile Netw (WiSec), 7
Cited by
Sorted by citations
Deep Learning for Encrypted Traffic Classification: An Overview
Rezaei, S., & Liu, X. (2019) · IEEE Communications Magazine · doi:10.1109/mcom.2019.1800819 · Cited by 670
“Note that some studies divide the entire flow into several bursts and then classify each burst to detect different user actions [5].”
BackgroundLin, X., Xiong, G., Gou, G., Li, Z., Shi, J., & Yu, J. (2022) · Proceedings of the ACM Web Conference 2022 · doi:10.1145/3485447.3512217 · Cited by 599
“To this end, some works [27, 36] extract the statistical feature and employ classical machine learning algorithms to handle the encrypted traffic without plaintext (Figure 1(b)).”
BackgroundMethodInfluentialFS-Net: A Flow Sequence Network For Encrypted Traffic Classification
Liu, C., He, L., Xiong, G., Cao, Z., & Li, Z. (2019) · IEEE INFOCOM 2019 - IEEE Conference on Computer Communications · doi:10.1109/infocom.2019.8737507 · Cited by 630
“The general procedures include feature engineering and model training [5]–[8], [13].”
BackgroundMethodAceto, G., Ciuonzo, D., Montieri, A., & Pescapè, A. (2019) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2019.2899085 · Cited by 525
“Based on a dataset of real users’ activity (as opposed to [10], [13], [29], and [30], employing bot-generated mobile traffic), combination results present a performance gain according to all considered metrics.”
BackgroundMethodInfluentialMIMETIC: Mobile encrypted traffic classification using multimodal deep learning
Aceto, G., Ciuonzo, D., Montieri, A., & Pescapè, A. (2019) · Computer Networks · doi:10.1016/j.comnet.2019.106944 · Cited by 291
“cation and complexity standpoints) of MIMETIC approach and methodically compares it to existing (single-modality) DL alternatives [11, 13], approaches to fuse their information [21], and ML-based state-of-the-art in mobile TC [7].”
BackgroundMethodInfluential
Metadata
- Authors
- Taylor, V. F., Spolaor, R., Conti, M., & Martinovic, I.
- Affiliations
- University of Oxford (GB)
- University of Padua (IT)
- Venue
- IEEE Transactions on Information Forensics and Security
- Published
- 2018-01
- Volume
- 13
- Issue
- 1
- Pages
- 63-78
- ISSN
- 1556-6013 (ISSN-L)
- 1556-6021
- OpenAlex
- W2609737443
- Cited by
- 439
- References
- 30
- Citations by year
- 2026: 47 · 2025: 69 · 2024: 63 · 2023: 55 · 2022: 60 · 2021: 45 · 2020: 41 · 2019: 39 · 2018: 18
- FWCI
- 16.15
- Type
- journal article
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- IEEE Transactions on Information Forensics and Security (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- Padua Research Archive (University of Padova) (submittedVersion, other-oa)
- arXiv (Cornell University)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Physical Sciences › Computer Science › Information Systems › Digital and Cyber Forensics
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Keywords
- encrypted traffic analysis, packet size, SSL/TLS, passive eavesdropping, privacy leakage
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
