FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic
Open accessAbstract
Mobile-application fingerprinting of network traffic is valuable for many security solutions as it provides insights into the apps active on a network.Unfortunately, existing techniques require prior knowledge of apps to be able to recognize them.However, mobile environments are constantly evolving, i.e., apps are regularly installed, updated, and uninstalled.Therefore, it is infeasible for existing fingerprinting approaches to cover all apps that may appear on a network.Moreover, most mobile traffic is encrypted, shows similarities with other apps, e.g., due to common libraries or the use of content delivery networks, and depends on user input, further complicating the fingerprinting process.As a solution, we propose FLOWPRINT, a semi-supervised approach for fingerprinting mobile apps from (encrypted) network traffic.We automatically find temporal correlations among destination-related features of network traffic and use these correlations to generate app fingerprints.Our approach is able to fingerprint previously unseen apps, something that existing techniques fail to achieve.We evaluate our approach for both Android and iOS in the setting of app recognition, where we achieve an accuracy of 89.2%, significantly outperforming stateof-the-art solutions.In addition, we show that our approach can detect previously unseen apps with a precision of 93.5%, detecting 72.3% of apps within the first five minutes of communication.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Early plaintext fingerprint methods are not applicable to newly emerging encrypted techniques such as TLS 1.3 because the plaintext becomes more sparse or obfuscated.
“However, these methods are not applicable to the newly emerging encrypted techniques ( e.g. TLS 1.3) since the plaintext becomes more sparse or obfuscated.”
From ET-BERT: A Contextualized Datagram Representation with Pre-training Transformers for Encrypted Traffic Classification (2022) · cites this paper as [37]
The ‘Detection of Previously Unseen Apps’ section says that two earlier detectors handle only unencrypted data and cannot be applied to encrypted traffic. The paper does not attribute that limitation specifically to TLS 1.3 or say that plaintext becomes sparser or obfuscated; the Feature Exploration section instead describes which features remain available in TLS-encrypted traffic. Page numbers are not available in our copy. (LLM, conf=0.84)
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
A Probabilistic Interpretation of Precision, Recall and F-Score, with Implication for Evaluation
Goutte, C., & Gaussier, E. (2005) · Lecture Notes in Computer Science · doi:10.1007/978-3-540-31865-1_25 · Cited by 2,285 · see citing works
Robust Smartphone App Identification via Encrypted Network Traffic Analysis
Taylor, V. F., Spolaor, R., Conti, M., & Martinovic, I. (2018) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2017.2737970 · Cited by 439 · cited 24× · see citing works
“Here, we compare our approach against AppScanner [62], a supervised state-of-theart technique to recognize apps in network traffic.”
BackgroundResultInfluential
Flagged first, then by citations
Research works printed but not linked: 52
- Abbas Acar, Hossein Fereidooni, Tigist Abera, Amit Kumar Sikder, Markus Miettinen, Hidayet Aksu, Mauro Conti, Ahmad-Reza Sadeghi, and A. Selcuk Uluagac. Peek-a-Boo: I see your smart home activities, even encrypted! arXiv preprint arXiv:1808.02741, 2018. · arXiv
- Giuseppe Aceto, Domenico Ciuonzo, Antonio Montieri, and Antonio Pescapé. Multi-Classification Approaches for Classifying Mobile App Traffic. Journal of Network and Computer Applications, 2018.
- Jagdish Prasad Achara, Gergely Acs, and Claude Castelluccia. On the Unicity of Smartphone Applications. In Proc. of the ACM Workshop on Privacy in the Electronic Society (WPES), 2015.
- Khaled Al-Naami, Swarup Chandra, Ahmad Mustafa, Latifur Khan, Zhiqiang Lin, Kevin Hamlen, and Bhavani Thuraisingham. Adaptive Encrypted Traffic Fingerprinting With Bi-Directional Dependence. In Proc. of the Annual Computer Security Applications Conference (AC- SAC), 2016.
- Hasan Faik Alan and Jasleen Kaur. Can Android Applications Be Identified Using Only TCP/IP Headers of Their Launch Time Traffic? In Proc. of the ACM Conference on Security & Privacy in Wireless and Mobile Networks (WiSec), 2016.
- Blake Anderson and David McGrew. Identifying Encrypted Malware Traffic with Contextual Flow Data. In Proc. of the ACM Workshop on Artificial Intelligence and Security (AISec), 2016.
- Blake Anderson and David McGrew. TLS Beyond the Browser: Combining End Host and Network Data to Understand Application Behavior. In Proc. of the ACM Internet Measurement Conference (IMC), 2019.
- Blake Anderson, Subharthi Paul, and David McGrew. Deciphering Malware's use of TLS (without Decryption). Journal of Computer Virology and Hacking Techniques, 2018.
- Michael Backes, Sven Bugiel, and Erik Derr. Reliable Third-Party Library Detection in Android and its Security Applications. In Proc. of the ACM Conference on Computer and Communications Security (CCS), 2016.
- Taimur Bakhshi and Bogdan Ghita. On Internet Traffic Classification: A Two-Phased Machine Learning Approach. Journal of Computer Networks and Communications, 2016.
- Laurent Bernaille, Renata Teixeira, Ismael Akodkenou, Augustin Soule, and Kave Salamatian. Traffic Classification On The Fly. ACM SIGCOMM Computer Communication Review, 2006.
- Matthias Böhmer, Brent Hecht, Johannes Schöning, Antonio Krüger, and Gernot Bauer. Falling Asleep with Angry Birds, Facebook and Kindle -A Large Scale Study on Mobile Application Usage. In Proc. of the International Conference on Human-Computer Interaction with Mobile Devices and Services (MobileHCI), 2011.
- Riccardo Bortolameotti, Thijs van Ede, Marco Caselli, Maarten H Everts, Pieter Hartel, Rick Hofstede, Willem Jonker, and Andreas Peter. DECANTeR: DEteCtion of Anomalous outbouNd HTTP TRaffic by Passive Application Fingerprinting. In Proc. of the Annual Computer Security Applications Conference (ACSAC), 2017.
- Riccardo Bortolameotti, Thijs van Ede, Andrea Continella, Thomas Hupperich, Maarten Everts, Reza Rafati, Willem Jonker, Pieter Hartel, and Andreas Peter. HeadPrint: Detecting Anomalous Communications through Header-based Application Fingerprinting. In Proc. of the ACM Symposium on Applied Computing (SAC), 2020.
- Yi Chen, Wei You, Yeonjoon Lee, Kai Chen, XiaoFeng Wang, and Wei Zou. Mass Discovery of Android Traffic Imprints through Instantiated Partial Execution. In Proc. of the ACM Conference on Computer and Communications Security (CCS), 2017.
- Yi-Chao Chen, Yong Liao, Mario Baldi, Sung-Ju Lee, and Lili Qiu. OS Fingerprinting and Tethering Detection in Mobile Networks. In Proc. of the ACM Internet Measurement Conference (IMC), 2014.
- Zhengyang Chen, Bowen Yu, Yu Zhang, Jianzhong Zhang, and Jingdong Xu. Automatic Mobile Application Traffic Identifica- tion by Convolutional Neural Networks. In Proc. of IEEE Trust- com/BigDataSE/ISPA, 2016.
- Yeongrak Choi, Jae Yoon Chung, Byungchul Park, and James Won-Ki Hong. Automated classifier generation for application-level mobile traffic identification. In Proc. of the IEEE/IFIP Network Operations and Management Symposium (NOMS), 2012.
- Stefano Comino, Fabio M. Manenti, and Franco Mariuzzo. Updates Management in Mobile Applications. iTunes vs Google Play. Journal of Economics & Management Strategy, 2018.
- Mauro Conti, Luigi V. Mancini, Riccardo Spolaor, and Nino Vincenzo Verde. Can't You Hear Me Knocking: Identification of User Actions on Android Apps via Traffic Analysis. In Proc. of the ACM Conference on Data and Application Security and Privacy (CODASPY), 2015.
- Andrea Continella, Yanick Fratantonio, Martina Lindorfer, Alessan- dro Puccetti, Ali Zand, Christopher Kruegel, and Giovanni Vigna. Obfuscation-Resilient Privacy Leak Detection for Mobile Apps Through Differential Analysis. In Proc. of the ISOC Network and Distributed System Security Symposium (NDSS), 2017.
- Shuaifu Dai, Alok Tongaonkar, Xiaoyin Wang, Antonio Nucci, and Dawn Song. NetworkProfiler: Towards Automatic Fingerprinting of Android Apps. In Proc. of the IEEE International Conference on Computer Communications (INFOCOM), 2013.
- Zakir Durumeric, Zane Ma, Drew Springall, Richard Barnes, Nick Sullivan, Elie Bursztein, Michael Bailey, J Alex Halderman, and Vern Paxson. The Security Impact of HTTPS Interception. In Proc. of the ISOC Network and Distributed System Security Symposium (NDSS), 2017.
- David Formby, Preethi Srinivasan, Andrew Leonard, Jonathan Rogers, and Raheem Beyah. Who's in Control of Your Control System? Device Fingerprinting for Cyber-Physical Systems. In Proc. of the ISOC Network and Distributed System Security Symposium (NDSS), 2016.
- Frolov, Sergey and Wustrow, Eric. The use of TLS in Censorship Circumvention. In Proc. of the ISOC Network and Distributed System Security Symposium (NDSS), 2019.
- Julien Gamba, Mohammed Rashed, Abbas Razaghpanah, Juan Tapiador, and Narseo Vallina-Rodriguez. An Analysis of Pre-installed Android Software. In Proc. of the IEEE Symposium on Security and Privacy (S&P), 2020.
- Aric Hagberg, Daniel Schult, and Pieter Swart. Exploring Network Structure, Dynamics, and Function using NetworkX. In Proc. of the Python in Science Conference (SciPy), 2008.
- Tin Kam Ho. Random Decision Forests. In Proc. of IEEE International Conference on Document Analysis and Recognition (ICDAR), 1995.
- Martin Lastovicka, Tomas Jirsik, Pavel Celeda, Stanislav Spacek, and Daniel Filakovsky. Passive OS Fingerprinting Methods in the Jungle of Wireless Networks. In Proc. of the IEEE/IFIP Network Operations and Management Symposium (NOMS), 2018.
- Fangfan Li, Arian Akhavan Niaki, David Choffnes, Phillipa Gill, and Alan Mislove. A Large-Scale Analysis of Deployed Traffic Differenti- ation Practices. In Proc. of the ACM Special Interest Group on Data Communication (SIGCOMM), 2019.
- Li Li, Daoyuan Li, Tegawendé F. Bissyandé, Jacques Klein, Yves Le Traon, David Lo, and Lorenzo Cavallaro. Understanding Android App Piggybacking: A Systematic Study of Malicious Code Grafting. IEEE Transactions on Information Forensics and Security, 2017.
- Marc Liberatore and Brian Neil Levine. Inferring the Source of Encrypted HTTP Connections. In Proc. of the ACM Conference on Computer and Communications Security (CCS), 2006.
- Martina Lindorfer, Matthias Neugschwandtner, Lukas Weichselbaum, Yanick Fratantonio, Victor Van Der Veen, and Christian Platzer. An- drubis -1,000,000 Apps Later: A View on Current Android Malware Behaviors. In Proc. of the IEEE International Workshop on Building Analysis Datasets and Gathering Experience Returns for Security (BADGERS), 2014.
- Wes McKinney et al. Data Structures for Statistical Computing in Python. In Proc. of the Python in Science Conference (SciPy), 2010.
- Stanislav Miskovic, Gene Moo Lee, Yong Liao, and Mario Baldi. AppPrint: Automatic Fingerprinting of Mobile Applications in Network Traffic. In Proc. of the International Conference on Passive and Active Network Measurement (PAM), 2015.
- Ioannis Papapanagiotou, Erich M Nahum, and Vasileios Pappas. Con- figuring DHCP Leases in the Smartphone Era. In Proc. of the ACM Internet Measurement Conference (IMC), 2012.
- Fabian Pedregosa et al. Scikit-learn: Machine Learning in Python. Journal of Machine Learning Research, 2011.
- Emanuele Petagna, Giuseppe Laurenza, Claudio Ciccotelli, and Leonardo Querzoni. Peel the Onion: Recognition of Android Apps Behind the Tor Network. In Proc. of the International Conference on Information Security Practice and Experience (ISPEC), 2019.
- Lawrence R. Rabiner and Bernard Gold. Theory and Application of Digital Signal Processing. Prentice Hall, 1975.
- Abbas Razaghpanah, Arian Akhavan Niaki, Narseo Vallina-Rodriguez, Srikanth Sundaresan, Johanna Amann, and Phillipa Gill. Studying TLS Usage in Android Apps. In Proc. of the ACM International Conference on emerging Networking EXperiments and Technologies (CoNEXT), 2017.
- Jingjing Ren, Martina Lindorfer, Daniel Dubois, Ashwin Rao, David Choffnes, and Narseo Vallina-Rodriguez. Bug Fixes, Improvements, ... and Privacy Leaks -A Longitudinal Study of PII Leaks Across Android App Versions. In Proc. of the ISOC Network and Distributed System Security Symposium (NDSS), 2018.
- Jingjing Ren, Ashwin Rao, Martina Lindorfer, Arnaud Legout, and David Choffnes. ReCon: Revealing and Controlling PII Leaks in Mobile Network Traffic. In Proc. of the International Conference on Mobile Systems, Applications and Services (MobiSys), 2016.
- Andrew Rosenberg and Julia Hirschberg. V-Measure: A Conditional Entropy-Based External Cluster Evaluation Measure. In Proc. of the Joint Conference on Empirical Methods in Natural Language Process- ing and Computational Natural Language Learning (EMNLP-CoNLL), 2007.
- Brendan Saltaformaggio, Hongjun Choi, Kristen Johnson, Yonghwi Kwon, Qi Zhang, Xiangyu Zhang, Dongyan Xu, and John Qian. Eavesdropping on Fine-Grained User Activities Within Smartphone Apps Over Encrypted Network Traffic. In Proc. of the USENIX Workshop on Offensive Technologies (WOOT), 2016.
- Asaf Shabtai, Uri Kanonov, Yuval Elovici, Chanan Glezer, and Yael Weiss. "Andromaly": a behavioral malware detection framework for Android devices. Journal of Intelligent Information Systems, 2012.
- Tim Stöber, Mario Frank, Jens Schmitt, and Ivan Martinovic. Who do you sync you are? Smartphone Fingerprinting via Application Behaviour. In Proc. of the ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec), 2013.
- Vincent F. Taylor, Riccardo Spolaor, Mauro Conti, and Ivan Martinovic. AppScanner: Automatic Fingerprinting of Smartphone Apps from En- crypted Network Traffic. In Proc. of the IEEE European Symposium on Security and Privacy (EuroS&P), 2016.
- Eline Vanrykel, Gunes Acar, Michael Herrmann, and Claudia Diaz. Leaky Birds: Exploiting Mobile Application Traffic for Surveillance. In Proc. of the International Conference on Financial Cryptography and Data Security (FC), 2016.
- Antoine Vastel, Pierre Laperdrix, Walter Rudametkin, and Romain Rouvoy. FP-STALKER: Tracking Browser Fingerprint Evolutions. In Proc. of the IEEE Symposium on Security and Privacy (S&P), 2018.
- Nguyen Xuan Vinh, Julien Epps, and James Bailey. Information Theoretic Measures for Clusterings Comparison: Variants, Properties, Normalization and Correction for Chance. Journal of Machine Learning Research, 2010.
- Yong Wang, Jinpeng Wei, and Karthik Vangury. Bring Your Own Device Security Issues and Challenges. In Proc. of the IEEE Consumer Communications and Networking Conference (CCNC), 2014.
- Hongyi Yao, Gyan Ranjan, Alok Tongaonkar, Yong Liao, and Zhuo- qing Morley Mao. SAMPLES: Self Adaptive Mining of Persistent LExical Snippets for Classifying Mobile Application Traffic. In Proc. of the ACM Annual International Conference on Mobile Computing and Networking (MobiCom), 2015.
Cited by
Sorted by citations
Lin, X., Xiong, G., Gou, G., Li, Z., Shi, J., & Yu, J. (2022) · Proceedings of the ACM Web Conference 2022 · doi:10.1145/3485447.3512217 · Cited by 599 · see citing works
“Early works [35] leverage the remaining plaintext in the encrypted traffic (e.”
BackgroundMethodInfluentialZhou, H., Hu, C., Yuan, Y., Cui, Y., Jin, Y., Chen, C., Wu, H., Yuan, D., Jiang, L., Wu, D., et al. (2024) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2024.3465447 · Cited by 277 · see citing works
“…ET-BERT, the authors conduct experiments across several encrypted traffic classification tasks, e.g., general encrypted application classification [132], encrypted malware classification, encrypted traffic classification on VPN [133], with the remarkable improvements over existing…”
BackgroundMethodInfluentialA Survey on Encrypted Network Traffic Analysis Applications, Techniques, and Countermeasures
Papadogiannaki, E., & Ioannidis, S. (2021) · ACM Computing Surveys · doi:10.1145/3457904 · Cited by 297 · see citing works
“Authors evaluate FLOWPRINT and they find that it is able to perform an accuracy of 89.2%.”
BackgroundMethodInfluentialRealtime Robust Malicious Traffic Detection via Frequency Domain Analysis
Fu, C.-P., Li, Q., Shen, M., & Xu, K. (2021) · Conference on Computer and Communications Security · doi:10.1145/3460120.3484585 · Cited by 273 · see citing works
“We emphasize that the malicious traffic detection is fully different from traffic classification [48, 58, 61, 66] that aims to classify whether traffic is generated by a certain network application or a certain user.”
BackgroundMethodNetwork traffic classification: Techniques, datasets, and challenges
Azab, A., Khasawneh, M., Alrabaee, S., Choo, K.-K. R., & Sarsour, M. (2022) · Digit. Commun. Networks · doi:10.1016/j.dcan.2022.09.009 · Cited by 247 · see citing works
Zhao, R.-J., Zhan, M.-W., Deng, X.-W., Wang, Y., Wang, Y.-J., Gui, G., & Xue, Z. (2023) · AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v37i4.25674 · Cited by 212 · see citing works
New Directions in Automated Traffic Analysis
Holland, J., Schmitt, P., Feamster, N., & Mittal, P. (2020) · Conference on Computer and Communications Security · doi:10.1145/3460120.3484758 · Cited by 212 · see citing works
“, application identification [8, 25, 56], device identification [17, 26]).”
Zhang, H., Yu, L., Xiao, X., Li, Q., Mercaldo, F., Luo, X.-P., & Liu, Q.-X. (2023) · The Web Conference · doi:10.1145/3543507.3583227 · Cited by 183 · see citing works
“From the Table 2, TFE-GNN is superior to almost all the baselines on public [8] 0.8713 0.8750 0.8748 0.8747 0.7551 0.7478 0.7354 0.7387 0.7771 0.7417 0.6209 0.6313 0.8741 0.8653 0.7792 0.8167 FlowPrint [32] 0.8538 0.7451 0.7917 0.7566 0.6944 0.7073 0.7310 0.7131 0.2400 0.0300 0.1250 0.0484 0.5243 0.7590 0.6074 0.6153…”
BackgroundInfluentialDetecting Unknown Encrypted Malicious Traffic in Real Time via Flow Interaction Graph Analysis
Fu, C.-P., Li, Q., & Xu, K. (2023) · Network and Distributed System Security Symposium · doi:10.48550/arxiv.2301.13686 · Cited by 167
“designed semi-supervised learning for mobile applications fingerprinting [78].”
BackgroundNetwork traffic classification for data fusion: A survey
Zhao, J., Jing, X., Yan, Z., & Witold Pedrycz, C. (2021) · Information Fusion · doi:10.1016/j.inffus.2021.02.009 · Cited by 155 · see citing works
“[126] Flow and packet level 1,9–11, 17 – Semi-supervised ReCon [127,128], Cross Platform [129], Andrubis [130] and Self-collection 89.”
MethodCharacterization and Prediction of Mobile-App Traffic Using Markov Modeling
Aceto, G., Bovenzi, G., Ciuonzo, D., Montieri, A., Persico, V., & Pescapè, A. (2021) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2021.3051381 · Cited by 83 · see citing works
“traffic, which evolves at fast pace [9], [10].”
BackgroundInfluentialA Comprehensive Survey of Recent Internet Measurement Techniques for Cyber Security
Pour, M. S., Nader, C., Friday, K., & Bou-Harb, E. (2023) · Computers & security · doi:10.1016/j.cose.2023.103123 · Cited by 121 · see citing works
Netmamba: Efficient Network Traffic Classification Via Pre-Training Unidirectional Mamba
Wang, T., Xie, X., Wang, W., Wang, C., Zhao, Y., & Cui, Y. (2024) · IEEE International Conference on Network Protocols (ICNP) · doi:10.1109/icnp61940.2024.10858569 · Cited by 115 · see citing works
DEEPCASE: Semi-Supervised Contextual Analysis of Security Events
van Ede, T., Aghakhani, H., Spahn, N., Bortolameotti, R., Cova, M., Continella, A., van Steen, M. R., Peter, A., Kruegel, C., & Vigna, G. (2022) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46214.2022.9833671 · Cited by 97 · see citing works
“We assume that detectors include information about each host involved in an event, either by leveraging an installed agent (host-based detection), or by deriving the host from the IP address and the logs of a DHCP server (network-based detection), a common assumption in enterprise networks [17].”
BackgroundSelf-citationXie, R., Wang, Y., Cao, J.-H., Dong, E., Xu, M.-W., Sun, K., Li, Q., Shen, L., & Zhang, M.-H. (2023) · USENIX Security Symposium · doi:10.1145/3603165.3607437 · Cited by 105
“A number of network security tasks have been built on top of it, such as application identification [53, 56, 65], website fingerprinting [46,49,51,52], malicious flow detection [33,37,38], and user profiling [16, 23].”
BackgroundTrafficFormer: An Efficient Pre-trained Model for Traffic Data
Zhou, G., Guo, X., Liu, Z., Li, T., Li, Q., & Xu, K. (2025) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp61157.2025.00102 · Cited by 98 · see citing works
Frequency Domain Feature Based Robust Malicious Traffic Detection
Fu, C.-P., Li, Q., Shen, M., & Xu, K. (2023) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2022.3195871 · Cited by 84 · see citing works
“Machine learning algorithms are widely used in traffic classification [40], [42], [43], [71]–[77].”
BackgroundMethodResultJi, I. H., Lee, J. H., Kang, M. J., Park, W. J., Jeon, S. H., & Seo, J. T. (2024) · Sensors · doi:10.3390/s24030898 · Cited by 74 · see citing works
Olszewski, D., Lu, A., Stillman, C., Warren, K., Kitroser, C., Pascual, A., Ukirde, D., Butler, K. R. B., & Traynor, P. (2023) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3576915.3623130 · Cited by 33 · see citing works
ATVITSC: A Novel Encrypted Traffic Classification Method Based on Deep Learning
Liu, Y., Wang, X., Qu, B., & Zhao, F. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3433446 · Cited by 75 · see citing works
“• Cross Platform (US Mobile APP) [44]: This dataset provides a large amount of mobile traffic for analysis and evaluation, which contains 59 Android traffic from the United States for specific classification tasks.”
BackgroundEC-GCN: A encrypted traffic classification framework based on multi-scale graph convolution networks
Diao, Z.-L., Xie, G.-G., Wang, X., Ren, R., Meng, X.-Y., Zhang, G.-X., Xie, K., & Qiao, M. (2023) · Comput. Networks · doi:10.1016/j.comnet.2023.109614 · Cited by 70 · see citing works
Pham, T., Ho, T., Truong-Huu, T., Cao, T.-D., & Truong, H.-L. (2021) · Asia-Pacific Computer Systems Architecture Conference · doi:10.1145/3485832.3485925 · Cited by 69 · see citing works
“4 seconds [44]) for observing diverse behavior and various functionalities of the apps.”
BackgroundMethodResultInfluentialDetecting DNS over HTTPS based data exfiltration
Zhan, M., Li, Y., Yu, G., Li, B., & Wang, W. (2022) · Comput. Networks · doi:10.1016/j.comnet.2022.108919 · Cited by 68
Hang, Z., Lu, Y.-L., Wang, Y., & Xie, Y. (2023) · International Symposium on Recent Advances in Intrusion Detection · doi:10.1145/3607199.3607206 · Cited by 66 · see citing works
“Removing the patch mask had a negligible effect on the model’s accuracyfortheCIC-IDS-2018,USTC-TFC-2016, andCross-Platform (Android) datasets, with changes below 0.06%.”
BackgroundMethodInfluentialDong, W., Yu, J., Lin, X.-J., Gou, G.-P., & Xiong, G. (2024) · Neurocomputing · doi:10.1016/j.neucom.2024.128444 · Cited by 63 · see citing works
Yan, J., Xu, H., Liu, Z., Li, Q., Xu, K., Xu, M.-W., & Wu, J.-P. (2024) · Symposium on Networked Systems Design and Implementation · doi:10.48550/arxiv.2403.11090 · Cited by 62
“Our community has proposed various ML-powered traffic analysis designs, such as intrusion detection [15,19,33], website fingerprinting [11,41,46,65], and encrypted traffic classification [39,47,48,55].”
MethodPacket-level prediction of mobile-app traffic using multitask Deep Learning
Montieri, A., Bovenzi, G., Aceto, G., Ciuonzo, D., Persico, V., & Pescapè, A. (2021) · Computer Networks · doi:10.1016/j.comnet.2021.108529 · Cited by 45 · see citing works
Trident: A Universal Framework for Fine-Grained and Class-Incremental Unknown Traffic Detection
Zhao, Z., Li, Z., Song, Z., Li, W., & Zhang, F. (2024) · International World Wide Web Conference (WWW) · doi:10.1145/3589334.3645407 · Cited by 46 · see citing works
“(iii) Six multi-classification anomaly detection: K-means [17], DB-SCAN [7], FlowPrint [48], Cls-Anomaly [55], SENC [36], and FARE [28].”
BFCN: A Novel Classification Method of Encrypted Traffic Based on BERT and CNN
Shi, Z., Luktarhan, N., Song, Y., & Tian, G. (2023) · Electronics · doi:10.3390/electronics12030516 · Cited by 57 · see citing works
“Fingerprint construction: There are two major classes of methods based on constructive fingerprinting techniques, one represented by deep packet inspection (DPI) [9] and the other by FlowPrint [6].”
BackgroundMethodInfluentialDE-GNN: Dual embedding with graph neural network for fine-grained encrypted traffic classification
Han, X., Xu, G., Zhang, M., Yang, Z., Yu, Z., Huang, W.-Q., & Meng, C. (2024) · Comput. Networks · doi:10.1016/j.comnet.2024.110372 · Cited by 56 · see citing works
SoK: The Impact of Unlabelled Data in Cyberthreat Detection
Apruzzese, G., Laskov, P., & Tastemirova, A. (2022) · European Symposium on Security and Privacy · doi:10.1109/eurosp53844.2022.00010 · Cited by 53 · see citing works
“, fingerprinting [87]) is orthogonal to this paper.”
BackgroundAn Encrypted Traffic Classification Method Combining Graph Convolutional Network and Autoencoder
Sun, B., Yang, W., Yan, M.-Q., Wu, D.-H., Zhu, Y., & Bai, Z. (2020) · IEEE International Performance, Computing, and Communications Conference · doi:10.1109/ipccc50635.2020.9391542 · Cited by 53 · see citing works
“Therefore, the classification of encrypted traffic has aroused great concern in academia and industry [2]–[6].”
BackgroundA Novel Self-Supervised Framework Based on Masked Autoencoder for Traffic Classification
Zhao, R.-J., Zhan, M.-W., Deng, X.-W., Li, F., Wang, Y., Wang, Y.-J., Gui, G., & Xue, Z. (2024) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2023.3335253 · Cited by 52 · see citing works
“To comprehensively evaluate the our method, we compare YaTC with a range of baselines and state-of-the-art methods, as listed below: • FlowPrint [23] and AppScanner [13] are ML-based meth-ods using statistical features for traffic classification.”
MethodCBSeq: A Channel-Level Behavior Sequence for Encrypted Malware Traffic Detection
Cui, S., Dong, C., Shen, M., Liu, Y., Jiang, B.-S., & Lu, Z.-G. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3300521 · Cited by 52 · see citing works
Fu, C., Li, Q. L., Xu, K., & Wu, J. (2023) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3576915.3616631 · Cited by 45 · see citing works
ProGraph: Robust Network Traffic Identification With Graph Propagation
Li, W., Zhang, X.-Y., Bao, H.-F., Shi, H., & Wang, Q. (2023) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2022.3216603 · Cited by 50 · see citing works
“This is because sessions from the same application are likely to be active synchronously and periodically during the lifetime of the application [4].”
BackgroundMethodInfluentialLichy, A., Bader, O., Ran, D.-B., Dvir, A., & Hajaj, C. (2022) · Computers & security · doi:10.48550/arxiv.2206.08004 · Cited by 50
“Previous works have shown that classical machine learning models are also applicable in the scope of QoE [5], mobile app fingerprinting [6]; or try to classify user activities [7]–[9] and webpage fingerprinting [10].”
Accurate mobile-app fingerprinting using flow-level relationship with graph neural networks
Jiang, M., Li, Z., Fu, P., Cai, W., Cui, M.-X., Xiong, G., & Gou, G.-P. (2022) · Comput. Networks · doi:10.1016/j.comnet.2022.109309 · Cited by 49 · see citing works
Packet-Level Open-World App Fingerprinting on Wireless Traffic
Li, J.-F., Wu, S., Zhou, H., Luo, X.-P., Wang, T., Liu, Y., & Ma, X. (2022) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2022.24210 · Cited by 47 · see citing works
“Similar open-world setting has also been considered in existing works [6], [22], [24].”
BackgroundMethodInfluentialFrom WHOIS to WHOWAS: A Large-Scale Measurement Study of Domain Registration Privacy under the GDPR
Lu, C.-Y., Liu, B., Zhang, Y.-M., Li, Z., Zhang, F.-L., Duan, H.-X., Liu, Y., Chen, J. Q., Liang, J., Zhang, Z., et al. (2021) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2021.23134 · Cited by 45
Revolutionizing Encrypted Traffic Classification with MH-Net: A Multi-View Heterogeneous Graph Model
Zhang, H., Yue, H.-D., Xiao, X., Yu, L., Li, Q., Ling, Z., & Zhang, Y. (2025) · AAAI Conference on Artificial Intelligence · doi:10.48550/arxiv.2501.03279 · Cited by 41
“Among them, statistic-based methods (Taylor et al. 2016; Hayes and Danezis 2016; van Ede et al. 2020; Panchenko et al. 2016; Xu, Geng, and Jin 2022) generally rely on hand-crafted traffic statistical features and then leverage a traditional machine learning model for classification.”
TrafficGPT: Breaking the Token Barrier for Efficient Long Traffic Analysis and Generation
Qu, J., Ma, X., & Li, J.-F. (2024) · arXiv.org · doi:10.48550/arxiv.2403.05822 · Cited by 40
“These pre-trained models showcase their superiority over non-pre-trained counterparts, such as K-fingerprinting [6], FS-Net [57], FlowPrint [58], and TSCRNN [59].”
MethodChallenges and Advances in Analyzing TLS 1.3-Encrypted Traffic: A Comprehensive Survey
Zhou, J., Fu, W., Hu, W., Sun, Z.-H., He, T., & Zhang, Z. (2024) · Electronics · doi:10.3390/electronics13204000 · Cited by 39 · see citing works
Flow Interaction Graph Analysis: Unknown Encrypted Malicious Traffic Detection
Fu, C.-P., Li, Q., & Xu, K. (2024) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2024.3370851 · Cited by 39 · see citing works
“Ede et al. designed semi-supervised learning for mobile applications fingerprinting [96].”
BackgroundEAPT: An encrypted traffic classification model via adversarial pre-trained transformers
Zhan, M.-M., Yang, J., Jia, D.-Q., & Fu, G. (2024) · Comput. Networks · doi:10.1016/j.comnet.2024.110973 · Cited by 38 · see citing works
Unmasking the Internet: A Survey of Fine-Grained Network Traffic Analysis
Feng, Y., Li, J., Mirkovic, J., Wu, C., Wang, C., Ren, H., Xu, J.-H., & Liu, Y. (2025) · IEEE Communications Surveys and Tutorials · doi:10.1109/comst.2025.3545541 · Cited by 36 · see citing works
“We believe designing and implementing new FGTA approaches that can work under these circumstances are directions worthy of future research.”
DDoS family: A novel perspective for massive types of DDoS attacks
Zhao, Z.-M., Li, Z.-X., Zhou, Z., Yu, J., Song, Z.-X., Xie, X.-F., Zhang, F., & Zhang, R. (2023) · Computers & security · doi:10.1016/j.cose.2023.103663 · Cited by 35
netFound: Principled Design for Network Foundation Models
Beltiukov, S., Guthula, S., Manda, H., Daneshamooz, J., Guo, W., Willinger, W., Gupta, A., & Monga, I. (2023) · doi:10.48550/arxiv.2310.17025 · Cited by 35
“To demonstrate the resulting problems in generalizability, we find and fix shortcuts for two commonly used downstream datasets: Crossmarket [34] and CIC-IDS-2017 [30], by removing the TCP Options field that contains class-unique timestamp in Crossmarkets and fixing the Heartbleed shortcut by…”
Effective DDoS Mitigation via ML-Driven In-Network Traffic Shaping
Zhao, Z., Liu, Z., Chen, H., Zhang, F., Song, Z., & Li, Z. (2024) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2023.3349180 · Cited by 35 · see citing works
“14(c), we perform the four-category classification task ( i.e., Chrome, Firefox, Sam-sung Internet, and UC) based on the browser dataset [54].”
MethodA Two-Phase Approach to Fast and Accurate Classification of Encrypted Traffic
Wang, Y.-P., He, H., Lai, Y., & Liu, A. X. (2023) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2022.3209979 · Cited by 34 · see citing works
“…[19], which comprehensively uses DNS information, certificate information, and packet length information of an TLS flow to carry out fine-grained encrypted traffic classi-fication. van Ede et al. design a semi-supervised encrypted network traffic classification system for Mobile Apps, FLOW-PRINT [20].”
MethodAppSniffer: Towards Robust Mobile App Fingerprinting Against VPN
Oh, S., Lee, M., Lee, H., Bertino, E., & Kim, H. (2023) · The Web Conference · doi:10.1145/3543507.3583473 · Cited by 34 · see citing works
“Techniques of the frst type, referred to as plaintext metadata-based techniques [8, 35, 45, 47], generate”
BackgroundMethodInfluentialde Carnavalet, X. D. C., & van Oorschot, P. (2020) · ACM Computing Surveys · doi:10.1145/3580522 · Cited by 31 · see citing works
“[120] propose a machine learning approach for creating mobile application ingerprints from encrypted network traic.”
BackgroundPrism: Real-Time Privacy Protection Against Temporal Network Traffic Analyzers
Li, W., Zhang, X., Bao, H., Yang, B., Li, Z., Shi, H., & Wang, Q. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3267885 · Cited by 29 · see citing works
“Typical ML-based methods such as Random Forest [52] learn from statistical features, including packet number, average packet size and average arrival time, etc. FlowPrint [22] generates fingerprints such as certificates, addresses or statistical features for each APP.”
BackgroundMethodCPS Device-Class Identification via Behavioral Fingerprinting: From Theory to Practice
Babun, L., Aksu, H., & Uluagac, S. (2021) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2021.3054968 · Cited by 27
Mapping the Landscape of Generative AI in Network Monitoring and Management
Bovenzi, G., Cerasuolo, F., Ciuonzo, D., Monda, D. D., Guarino, I., Montieri, A., Persico, V., & Pescapè, A. (2025) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2025.3543022 · Cited by 26 · see citing works
“[122] develop an LLM-based assistant designed to translate Request for Comments (RFCs) into a format compatible with Cryptographic Protocol Shapes Analyzer (CPSA).”
Analyzing the Feasibility and Generalizability of Fingerprinting Internet of Things Devices
Ahmed, D., Das, A., & Zaffar, F. (2022) · Proceedings on Privacy Enhancing Technologies · doi:10.2478/popets-2022-0057 · Cited by 26
Lin, X.-J., He, L.-T., Gou, G.-P., Yu, J., Guan, Z., Li, X., Guo, J., & Xiong, G. (2024) · Computers & security · doi:10.1016/j.cose.2024.103892 · Cited by 24 · see citing works
Unsupervised Detection and Clustering of Malicious TLS Flows
Gómez, G., Kotzias, P., Dell'Amico, M., Bilge, L., & Caballero, J. (2021) · Security and Communication Networks · doi:10.1155/1970/3676692 · Cited by 23
“[43] proposed FlowPrint, a semi-supervised approach for fingerprinting mobile apps from their TLS traffic using also destination features such as the server certificate, IP address, and port.”
BackgroundAN-Net: an Anti-Noise Network for Anonymous Traffic Classification
Deng, X.-W., Wang, Y.-J., & Xue, Z. (2024) · The Web Conference · doi:10.1145/3589334.3645691 · Cited by 22 · see citing works
“Inspired by their observation, we visualize the number of consecutive packets and their probability of belonging to the same flow on ISCX-nonTor [22], Cross-Platform [38], and Browser datasets (see Figure 2).”
MethodLet model keep evolving: Incremental learning for encrypted traffic classification
Li, X., Xie, J., Song, Q., Sang, Y.-F., Zhang, Y., Li, S.-H., & Zang, T. (2023) · Computers & security · doi:10.1016/j.cose.2023.103624 · Cited by 22 · see citing works
TSFN: A Novel Malicious Traffic Classification Method Using BERT and LSTM
Shi, Z., Luktarhan, N., Song, Y., & Yin, H. (2023) · Entropy · doi:10.3390/e25050821 · Cited by 22 · see citing works
“Fingerprint Construction: There are mainly two types of methods based on constructing fingerprinting techniques, one represented by Deep Packet Inspection [6] and the other by FlowPrint [7].”
InfluentialZhao, R.-J., Deng, X.-W., Wang, Y., Chen, L.-B., Liu, M., Xue, Z., & Wang, Y.-J. (2022) · International Workshop on Quality of Service · doi:10.1109/iwqos54832.2022.9812882 · Cited by 22 · see citing works
DNN Model Architecture Fingerprinting Attack on CPU-GPU Edge Devices
Patwari, K., Hafiz, S. M., Wang, H., Homayoun, H., Shafiq, Z., & Chuah, C. (2022) · IEEE European Symposium on Security and Privacy · doi:10.1109/eurosp53844.2022.00029 · Cited by 21 · see citing works
Landing AI on Networks: An Equipment Vendor Viewpoint on Autonomous Driving Networks
Rossi, D., & Zhang, L. (2022) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2022.3169988 · Cited by 22 · see citing works
“Furthermore, whereas OO/0D is useful in solving part of supervised models limits, further effort is needed to assist [113], [114] and explain [115] automated labeling of OO/0D traffic.”
Accurate TLS Fingerprinting using Destination Context and Knowledge Bases
Anderson, B., & McGrew, D. (2020) · arXiv.org · doi:10.48550/arxiv.2009.01939 · Cited by 22
“ight et al. [49] used the sequence of TCP packets and a hidden Markov model to identify application layer protocols. More recent work has focused on the mobile and IoT domains [46, 47, 51]. FlowPrint [47] takes a semi-supervised approach that allows it to fingerprint previously unseen mobile applications. FlowPrint co…”
Lens: A Knowledge-Guided Foundation Model for Network Traffic
Li, X.-C., Qian, C., Wang, Q., Kong, J.-T., Wang, Y.-C., Yao, Z., Ji, B., Cheng, L., Zhou, G., & Shao, H.-J. (2024) · Trans. Mach. Learn. Res. · doi:10.48550/arxiv.2402.03646 · Cited by 21
“Dataset Pretraining Finetuning ISCX-VPN[11] 60% 24% ISCX-Tor[14] 60% 24% USTC-TFC-2016[51] 60% 5% Cross Platform (Android)[46] NA 15% Cross Platform (IOS)[46] NA 26% CIC-DoHBrw-2020[32] 60% 6% CIC-IoT-2023[35] 60% 5% A.3 Benchmark Tasks”
A graph representation framework for encrypted network traffic classification
Okonkwo, Z., Foo, E., Hou, Z., Li, Q.-Y., & Jadidi, Z. (2025) · Computers & security · doi:10.1016/j.cose.2024.104134 · Cited by 21 · see citing works
“NTC has evolved from traditional methods like ports and Deep Packet Inspection (DPI) to advanced statistical, ML, and DL-based schemes [16, 35, 24, 33, 38, 9, 39, 49, 35, 26].”
MethodInfluentialGAP-WF: Graph Attention Pooling Network for Fine-grained SSL/TLS Website Fingerprinting
Lu, J., Gou, G.-P., Su, M., Song, D., Liu, C., Yang, C., & Guan, Y. (2021) · IEEE International Joint Conference on Neural Network · doi:10.1109/ijcnn52387.2021.9533543 · Cited by 21
“To classify mobile app traffic, FlowPrint [16] constructs the correlation graph according to the temporal correlation between flow clusters.”
BackgroundMethodA novel approach for application classification with encrypted traffic using BERT and packet headers
Yu, J., Choi, Y., Koo, K., & Moon, D. (2024) · Computer Networks · doi:10.1016/j.comnet.2024.110747 · Cited by 21 · see citing works
Resource Knowledge-Driven Heterogeneous Graph Learning for Website Fingerprinting
Gao, B., Liu, W.-W., Liu, G.-J., & Nie, F. (2024) · IEEE Transactions on Cognitive Communications and Networking · doi:10.1109/tccn.2024.3350531 · Cited by 19 · see citing works
“To conduct the evaluation, we compare the RK-HSTGCN approach with eight state-of-the-art WF methods: SVM-WF [4], DBN-WF [6], HGNR [7], AppScanner [16], Deep Fingerprinting [20], FlowPrint [26], MIMETIC [34], and App-Net [35].”
MethodWang, X.-B., Yuan, Q.-J., Wang, Y.-J., Gou, G.-P., Gu, C., Yu, G., & Xiong, G. (2024) · Comput. Networks · doi:10.1016/j.comnet.2024.110403 · Cited by 19 · see citing works
Sun, P.-S., Li, S.-H., Xie, J., Xu, H.-B., Cheng, Z.-Y., & Yang, R. (2023) · Computers & security · doi:10.1016/j.cose.2023.103257 · Cited by 19 · see citing works
Ptu: Pre-Trained Model for Network Traffic Understanding
Peng, L., Xie, X., Huang, S., Wang, Z., & Cui, Y. (2024) · IEEE International Conference on Network Protocols (ICNP) · doi:10.1109/icnp61940.2024.10858503 · Cited by 5 · see citing works
“Flowprint [39] generates fingerprints for application classification based on IP addresses and other elements.”
InfluentialYang, X., Ruan, S., Yue, Y.-L., & Sun, B. (2024) · Comput. Networks · doi:10.1016/j.comnet.2023.110120 · Cited by 18 · see citing works
FG-SAT: Efficient Flow Graph for Encrypted Traffic Classification Under Environment Shifts
Cui, S., Han, X.-Y., Han, D.-Q., Wang, Z.-L., Wang, W., Jiang, B., Liu, B.-X., & Lu, Z.-G. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3571663 · Cited by 18 · see citing works
“Ede et al. [11] highlight the use of temporal correlations among destination-related features for generating application fingerprints.”
Lin, X., Xiong, G., Gou, G., Dong, W., Yu, J., Li, Z., & Xia, W. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3574971 · Cited by 18 · see citing works
Fast and Accurate Multi-Task Learning for Encrypted Network Traffic Classification
Park, J.-T., Shin, C.-Y., Baek, U.-J., & Kim, M.-S. (2024) · Applied Sciences · doi:10.3390/app14073073 · Cited by 17 · see citing works
“With the growing concerns regarding personal privacy and security, most applications now utilize encrypted traffic [37–39].”
BackgroundMM4flow: A Pre-trained Multi-modal Model for Versatile Network Traffic Analysis
Yang, L., Liu, L., Huang, J., Liu, Z., Liang, S.-Y., Fu, S.-J., & Wang, Y. (2025) · Conference on Computer and Communications Security · doi:10.1145/3719027.3744804 · Cited by 15 · see citing works
DevTag: A Benchmark for Fingerprinting IoT Devices
Wan, S., Li, Q., Wang, H., Li, H., & Sun, L. (2023) · IEEE Internet of Things Journal · doi:10.1109/jiot.2022.3225580 · Cited by 15
“Although prior works leveraged temporal periodicity of IoT characteristics [5], [15], they mainly used limited data sets and lacked publicly available network traffic data.”
MethodMPAF: Encrypted Traffic Classification With Multi-Phase Attribute Fingerprint
Chen, Y.-G., & Wang, Y.-P. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3428839 · Cited by 15 · see citing works
“In 2020, Van Ede et al. [15] released a new cross-platform dataset, which includes applications from iOS and Android operating systems.”
BackgroundMethodInfluentialTowards Context-Aware Traffic Classification via Time-Wavelet Fusion Network
Zhao, Z.-M., Song, Z.-X., Xie, X.-F., Li, Z.-X., Yu, J., Zhang, F., & Li, T.-T. (2025) · Knowledge Discovery and Data Mining · doi:10.1145/3690624.3709315 · Cited by 14 · see citing works
“App fingerprinting aims to identify specific applications or services by analyzing the characteristics of their generated network traffic [31, 60, 61] where ℎ𝑒𝑎𝑑 𝑖 = Self-Attention ( XW Qi , and W O ∈ R 𝑣 × are projection parameters.”
Incremental encrypted traffic classification via contrastive prototype networks
Cai, W., Hou, C., Cui, M.-X., Wang, B., Xiong, G., & Gou, G.-P. (2024) · Comput. Networks · doi:10.1016/j.comnet.2024.110591 · Cited by 14 · see citing works
Zhang, H., Xiao, X., Yu, L., Li, Q., Ling, Z.-H., & Zhang, Y. (2024) · arXiv.org · doi:10.48550/arxiv.2402.07501 · Cited by 14
“The comparison baselines include Flow-level Traffic Classification Methods (i.e., AppScanner [34], K-FP (K-Fingerprinting) [7], FlowPrint [37], CUMUL [24], GRAIN [45], FAAR [20], ETC-PS [41], FS-Net [19], DF [33], EDC [16], FFB [46], MVML [5], ET-BERT [18], GraphDApp [32], ECD-GNN [12], TFE-GNN [47]) and Packet-level…”
BackgroundMethodInfluentialRobust network traffic identification with graph matching
Li, W., Zhang, X.-Y., Bao, H.-F., Wang, Q., & Li, Z. (2022) · Comput. Networks · doi:10.1016/j.comnet.2022.109368 · Cited by 14 · see citing works
Few-shot traffic classification based on autoencoder and deep graph convolutional networks
Xu, S., Han, J., Liu, Y., Liu, H., & Bai, Y. (2025) · Scientific Reports · doi:10.1038/s41598-025-94240-6 · Cited by 13 · see citing works
“Unlike DPI, traditional machine learning-based methods rely on statistical features, enabling them to handle encrypted traffic 2,5–8 .”
TrafCL: Robust Encrypted Malicious Traffic Detection via Contrastive Learning
Yang, X., Ruan, S., Li, J.-Y., Yue, Y.-L., & Sun, B. (2024) · International Conference on Information and Knowledge Management · doi:10.1145/3627673.3679839 · Cited by 13 · see citing works
“…our TrafCL with the following state-of-the-art baselines of encrypted traffic classification, including: • Statistical methods : (1) FlowPrint [37], which extracts features from devices, certificates, packet sizes and timestamps, then clusters to build fingerprints, and classifies traffics…”
TLS fingerprint for encrypted malicious traffic detection with attributed graph kernel
Yu, L., Tao, J., Xu, Y., Sun, W., & Wang, Z. (2024) · Comput. Networks · doi:10.1016/j.comnet.2024.110475 · Cited by 13 · see citing works
Targeted Privacy Attacks by Fingerprinting Mobile Apps in LTE Radio Layer
Baek, J., Soundrapandian, P., Kyung, S., Wang, R.-Y., Shoshitaishvili, Y., Doupé, A., & Ahn, G.-J. (2023) · Dependable Systems and Networks · doi:10.1109/dsn58367.2023.00035 · Cited by 13
Encrypted traffic classification encoder based on lightweight graph representation
Chen, Z., Wei, X.-X., & Wang, Y.-S. (2025) · Scientific Reports · doi:10.1038/s41598-025-05225-4 · Cited by 12 · see citing works
Bayat, M., Garshasbi, J., Mehdizadeh, M., Nozari, N., Khesal, A. R., Dokhaei, M., & Teimouri, M. (2024) · BMC Research Notes · doi:10.1186/s13104-024-06817-5 · Cited by 12 · see citing works
“This challenge stems from the unpredictable nature of real-world network environments [15, 16] and the dynamic and evolving behavior of mobile apps [13, 17–19].”
BackgroundNetBench: A Large-Scale and Comprehensive Network Traffic Benchmark Dataset for Foundation Models
Qian, C., Li, X.-C., Wang, Q.-N., Zhou, G., & Shao, H.-J. (2024) · 2024 IEEE International Workshop on Foundation Models for Cyber-Physical Systems & Internet of Things (FMSys) · doi:10.1109/fmsys62467.2024.00008 · Cited by 12 · see citing works
“For the classification benchmark, we construct 15 tasks across 7 datasets, including ISCXVPN 2016 [2], ISCXTor 2016 [3], USTC-TFC 2016 [4], Cross-Platform [5] dataset containing both Android and IOS applications, CIRA-CIC-DoHBrw 2020 [6], and CIC IoT Dataset 2023 [7].”
MethodHoneyKube: Designing and Deploying a Microservices-based Web Honeypot
Gupta, C., van Ede, T., & Continella, A. (2023) · 2023 IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw59333.2023.00005 · Cited by 12 · see citing works
“It is a common assumption in threat monitoring systems [32],”
BackgroundSelf-citationPKDGA: A Partial Knowledge-Based Domain Generation Algorithm for Botnets
Nie, L., Shan, X., Zhao, L., & Li, K.-Q. (2022) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3298229 · Cited by 12 · see citing works
“Following the prior works [57], [58], a grid search is exploited to tune PKDGA’s hyper-parameters, i.”
FingerprinTV: Fingerprinting Smart TV Apps
Varmarken, J., Aaraj, J. A., Trimananda, R., & Markopoulou, A. (2022) · Proceedings on Privacy Enhancing Technologies · doi:10.56553/popets-2022-0088 · Cited by 12 · see citing works
A novel model for voice command fingerprinting using deep learning
Mao, J., Wang, C.-Y., Guo, Y.-H., Xu, G.-A., Cao, S., Zhang, X.-W., & Bi, Z. (2022) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2021.103085 · Cited by 12 · see citing works
unFlowS: An Unsupervised Construction Scheme of Flow Spectrum for Network Traffic Detection
Yang, L., Wang, Y., Liu, L., Huang, J., Shi, J., Fu, S., & Guo, S. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3550060 · Cited by 11 · see citing works
“Flowprint proposed by Van Ede et al. [36] automatically find temporal correlations among destination-related features of network tra ffi c and use these correlations to generate app fingerprints.”
AMDetector: Detecting Large-Scale and Novel Android Malware Traffic with Meta-learning
Li, W., Bao, H.-F., Zhang, X.-Y., & Li, L. (2022) · International Conference on Conceptual Structures · doi:10.1007/978-3-031-08760-8_33 · Cited by 12 · see citing works
“…the state-of-the-art baselines for DoridMal traffic classification, including XGBoost-based method [17], RandomForest-based method [7], FlowPrint [8], conversation-level Features-based method [1], CNN-based method [21], GAN-based method [14], SiameseNet [11], FS-Net [13], TripletNet [9] and RBRN…”
MethodNetwork traffic foundation models: A systematic review
Pérez-Jove, R., Munteanu, C., Dorado, J., Pazos, A., & Vázquez-Naya, J. (2026) · Comput. Networks · doi:10.1016/j.comnet.2026.111998 · Cited by 11 · see citing works
Zou, A., Yang, W., Tang, C.-W., Lu, J., & Guo, J.-Y. (2024) · Computers & electrical engineering · doi:10.1016/j.compeleceng.2024.109406 · Cited by 11 · see citing works
Liu, T., Ma, X., Liu, L., Liu, X., Zhao, Y., Hu, N., & Ghafoor, K. (2024) · Mathematics · doi:10.3390/math12111624 · Cited by 11 · see citing works
- Authors
- van Ede, T., Bortolameotti, R., Continella, A., Ren, J., Dubois, D. J., Lindorfer, M., Choffnes, D., van Steen, M., & Peter, A.
- Affiliations
- University of California, Santa Barbara (US)
- Northeastern University (US)
- TU Wien (AT)
- University of Twente (NL)
- Venue
- Proceedings 2020 Network and Distributed System Security Symposium
- Publisher
- Internet Society
- Published
- 2020
- OpenAlex
- W3007562398
- Cited by
- 339
- References
- 51
- Citations by year
- 2026: 66 · 2025: 92 · 2024: 72 · 2023: 49 · 2022: 38 · 2021: 18 · 2020: 4
- FWCI
- 10.41
- Type
- conference paper
- Language
- en
- Open access
- bronze
- doi.org
- Locations
- Network and Distributed System Security Symposium (publishedVersion)
- University of Twente Research Information (publishedVersion, other-oa)
- University of Twente Research Information (submittedVersion, other-oa)
- Funders
- National Science Foundation (1909020)
- Österreichische Nationalstiftung für Forschung, Technologie und Entwicklung
- Comcast Innovation Fund
- Nederlandse Organisatie voor Wetenschappelijk Onderzoek
- Bundesministerium für Verkehr, Innovation und Technologie
- Christian Doppler Forschungsgesellschaft
- Bundesministerium für Digitalisierung und Wirtschaftsstandort
- SBA Research
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Physical Sciences › Computer Science › Information Systems › Mobile and Web Applications
- Physical Sciences › Computer Science › Signal Processing › Advanced Malware Detection Techniques
- Keywords
- encrypted traffic, semi-supervised learning, temporal correlation, Android, iOS, network traffic analysis
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
