Exploiting Diversity in Android TLS Implementations for Mobile App Traffic Classification

“In the few cases (5 apps) where lesser than 10 , 000 packets are available, we employ SMOTE [14] and oversample the datasets, so as to balance them.”

“Some of the earlier works can be found in a survey by Nguyen et al. in [39], and references therein.”

“The avalanche effect mandates that a small change (even a bit) in the plaintext should create significant changes (alter a large number of bits) in the ciphertext [25].”

“, where side-channel leaks in terms of packet-size, arrival time, and stateful interactions between servers and clients of web applications, were exploited [15].”

“In fact, the majority of mobile apps tunnel data over HTTP and HTTPS [24, 28], which use the same port (80 and 443 for HTTP and HTTPS respectively) for all traffic.”

“Tool for side-channel attacks: It follows from the previous discussion, therefore, that along with packet-level and traffic meta-data (e.g., direction of traffic) based features [17, 45, 48], bit-sequence based features can also pose threats via side-channel attacks.”

“Unlike in the case of traditional web traffic, mobile app traffic cannot be segregated based on the presence of obvious signatures (e.g., server address, app port number, unique identifiers in packet content, etc. [12]).”

“) fetched during the launch of a webpage [47].”

“Another recent work studied privacy vulnerabilities in a IoT based smart home system, made possible by traffic analysis [9].”

“compiled a comprehensive survey of these techniques – however, they note, likemany others, that DPI based approaches either perform abysmally, or fail entirely when traffic is encrypted [26].”

“which suggested employing Fourier analysis to analyze the quality of random number generators [19].”

“For example, these features could be leveraged to infer user actions from mobile phone traffic, which could lead to severe breach of privacy for users [18, 37, 49].”

“Tool for side-channel attacks: It follows from the previous discussion, therefore, that along with packet-level and traffic meta-data (e.g., direction of traffic) based features [17, 45, 48], bit-sequence based features can also pose threats via side-channel attacks.”

“showed that by executing different apps in an emulator and gathering corresponding network traces, it is possible to build signatures for identifying specific traffic sources [20].”

“The completeness property demands that all bits in the plaintext should affect each bit in the ciphertext [34].”

“Bujlow et al. proposed a learning model with features based on individual and aggregate payload sizes, along with IP and port no. based rules [11].”

“However, cipher implementations are seldom perfectly random; existing literature shows that different cipher implementations are characterizedwith different degrees of randomness [8, 23, 35, 44, 52].”

“We introduce packet-level features in this subsection, such as those based on packet-size and packet inter-arrival time, which have been widely used in the literature for app-traffic classification [7, 27, 42, 46].”

“, and a machine learning based solution was provided using packet-level features [27].”

“In fact, the majority of mobile apps tunnel data over HTTP and HTTPS [24, 28], which use the same port (80 and 443 for HTTP and HTTPS respectively) for all traffic.”

“Detection of Domain Generation Algorithm (DGA) based botnets was proposed using DNS traffic analysis in a recent work by Wang et al. [50].”

“For example, these features could be leveraged to infer user actions from mobile phone traffic, which could lead to severe breach of privacy for users [18, 37, 49].”

“Tool for side-channel attacks: It follows from the previous discussion, therefore, that along with packet-level and traffic meta-data (e.g., direction of traffic) based features [17, 45, 48], bit-sequence based features can also pose threats via side-channel attacks.”

“reduced the overhead of building signatures where they used context of signatures to improve identification accuracy and scalability [54].”

“We introduce packet-level features in this subsection, such as those based on packet-size and packet inter-arrival time, which have been widely used in the literature for app-traffic classification [7, 27, 42, 46].”

“Automatic generation of classifiers for traffic identification has been presented in [16, 53].”

“proposed using side-channel attacks to determine round-trip times (RTTs), and then clustering traffic with similar RTTs [29].”

“However, cipher implementations are seldom perfectly random; existing literature shows that different cipher implementations are characterized with different degrees of randomness [8, 23, 35, 44, 52].”

“A recent study reveals that in case of mobile platforms (and specifically the Android OS), there exists significant diversity in the implementation of TLS/SSL, with a vast majority of those implementations falling short of the adequate security standards [41].”

“Applications which authenticate users based on their app activity history [21, 30], may also be fooled if app activities could be gleaned out using our proposed features.”

“Additionally, this technique is not only resistant towards obfuscation, but is also simple to implement, since it requires computing the Fast Fourier Transform of a bit-stream (specialized hardware is available for such tasks [6]), and some additional computation.”

“Automatic generation of classifiers for traffic identification has been presented in [16, 53].”

“Piskac et al. suggested protocol detection from web traffic, again using packet-size and arrival time values [40].”

“Protection against obfuscation: Some works have pointed out the privacy risks involved when statistical analysis of packet-level features is used to differentiate traffic [32, 51].”

“exploited the user agent field, and other common strings found in the HTTP headers of packets generated by the same application [31].”

“have also shown that encrypted, and even tunneled (using a Virtual Private Network (VPN)) video sources, can be identified by analyzing simple features derived from packet-sizes and temporal patterns of packet arrival [10, 43].”

“cluding a recent work [13] propose obfuscating such features so that classifiers may not be able to extract useful information out of application traffic.”

“have also shown that encrypted, and even tunneled (using a Virtual Private Network (VPN)) video sources, can be identified by analyzing simple features derived from packet-sizes and temporal patterns of packet arrival [10, 43].”

“We introduce packet-level features in this subsection, such as those based on packet-size and packet inter-arrival time, which have been widely used in the literature for app-traffic classification [7, 27, 42, 46].”

“As an application of network traffic analysis, a recent work by Das et al. proposed privacy-aware localization using a supervised learning approach [22].”

“[31] exploit the randomness difference between different ciphertexts to distinguish different applications, which suggests that the encrypted traffic is not perfectly random”

“In encrypted traffic, despite the absence of explicit semantics of the payload in the packets, Sengupta [22] exploited randomness differences between different encrypted traffic to identify the traffic, demonstrating that the encrypted traffic is not absolute and perfectly random, but there exist implicit patterns.”

“, Chrome, Spotify) [24], [25].”

“Despite the lack of obvious semantics of packet payloads in encrypted traffic, Sengupta [21] used the randomness differences between different encrypted traffic to classify traffic, showing that encrypted traffic is not entirely random but has underlying patterns.”

“This bit and byte level information mining by both methods [34, 10] shows that encrypted bits of data when processed can be used for classification tasks.”

“Sengupta et al. [18] exploited the diference in randomness between diferent ciphertexts to distinguish encrypted trafc generated by diferent applications and fnd that the encrypted trafc is not completely random and there is a fxed implicit pattern.”

“…that are based on classical ML models (e.g., support vector machine, decision trees, random forest) are able to achieve a high level of accuracy [4], [5] by leveraging statistical characteristics of network flows (e.g., mean packet inter-arrival time) and without requiring to inspect packets’…”

“Authors in [5] believe that different encrypted software leaves distinct Footprints.”

“For instance, methods based on spatio-temporal dual-stream networks require separate training of CNN and RNN modules [6, 7], while hybrid models integrating self-attention mechanisms have exponentially increasing parameters [8–10], making them difficult to deploy in edge devices.”

“Sengupta et al. [24] improved Deep Packet Inspection performance by approximately five percent using pre-trained models, while subsequent studies have adopted domain adaptation techniques for encrypted mobile traffic classification [25].”

“Our contribution is a statistics-level dissection of the randomness-testing evidence in Sengupta et al. [31] and Kanda and Hashimoto [17], together with the analytical length-proxy result in Section 6.”

“Sengupta et al. [27] used the difference in randomness between ciphertexts to distinguish applications, showing that encrypted traffic is not completely random and contains potential patterns.”

“Deep learning methods, which automatically extract high-level features from encrypted flows, have become a mainstream approach for encrypted traffic classification [15].”

“Time-series analyses are common in malicious traffic detection [24, 28, 38, 47], which are good at capturing the dependencies in the local time domain.”

“Service identification is a typical traffic classification task [4], [27].”

“Time-series analysis methods are more common for in malicious traffic detection tasks [17, 21, 29, 37].”

“Most existing methods analyze traffic data only from a single modality, e.g., text modality [24, 31] and time series modality [18, 36].”

“In encrypted traffic classification, although payloads have no semantics, Sengupta et al. [25] exploit differences in randomness of data generated by different applications, which shows that the encrypted traffic is not absolutely random and remains some implicit patterns.”

“In encrypted traffic, Sengupta [20] utilized the variance in randomness among different encrypted traffic to identify patterns, demonstrating that encrypted traffic is not entirely random and contains implicit patterns.”

“classifying do not work well for mobile apps due to the lack of unique signatures [20].”

“Although encryption makes the payload look cluttered and unsemantic, Sengupta et al. [50] exploit the randomness di ff erence between di ff erent ciphertexts to distinguish di ff erent applications, which suggests that the encrypted tra ffi c is not perfectly random and implicit patterns exist.”