The DOI matches its Crossref record, with a small difference in title or year; 3 of the 3 references it cites were found in a registry or an index.
FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic
Open accessAbstract
Mobile-application fingerprinting of network traffic is valuable for many security solutions as it provides insights into the apps active on a network.Unfortunately, existing techniques require prior knowledge of apps to be able to recognize them.However, mobile environments are constantly evolving, i.e., apps are regularly installed, updated, and uninstalled.Therefore, it is infeasible for existing fingerprinting approaches to cover all apps that may appear on a network.Moreover, most mobile traffic is encrypted, shows similarities with other apps, e.g., due to common libraries or the use of content delivery networks, and depends on user input, further complicating the fingerprinting process.As a solution, we propose FLOWPRINT, a semi-supervised approach for fingerprinting mobile apps from (encrypted) network traffic.We automatically find temporal correlations among destination-related features of network traffic and use these correlations to generate app fingerprints.Our approach is able to fingerprint previously unseen apps, something that existing techniques fail to achieve.We evaluate our approach for both Android and iOS in the setting of app recognition, where we achieve an accuracy of 89.2%, significantly outperforming stateof-the-art solutions.In addition, we show that our approach can detect previously unseen apps with a precision of 93.5%, detecting 72.3% of apps within the first five minutes of communication.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“However, these methods are not applicable to the newly emerging encrypted techniques ( e.g. TLS 1.3) since the plaintext becomes more sparse or obfuscated.”
From ET-BERT: A Contextualized Datagram Representation with Pre-training Transformers for Encrypted Traffic Classification (2022) · cites this paper as [37]
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
A Probabilistic Interpretation of Precision, Recall and F-Score, with Implication for Evaluation
Goutte, C., & Gaussier, E. (2005) · Lecture Notes in Computer Science · doi:10.1007/978-3-540-31865-1_25 · Cited by 2,285
Robust Smartphone App Identification via Encrypted Network Traffic Analysis
Taylor, V. F., Spolaor, R., Conti, M., & Martinovic, I. (2018) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2017.2737970 · Cited by 439 · cited 24×
“Here, we compare our approach against AppScanner [62], a supervised state-of-theart technique to recognize apps in network traffic.”
BackgroundResultInfluentialAdaptive encrypted traffic fingerprinting with bi-directional dependence
Al-Naami, K., Chandra, S., Mustafa, A., Khan, L., Lin, Z., Hamlen, K., & Thuraisingham, B. (2016) · Proceedings of the 32nd Annual Conference on Computer Security Applications · doi:10.1145/2991079.2991123 · Cited by 145
Flagged first, then by citations
Research works printed but not linked: 51
- Abbas Acar, Hossein Fereidooni, Tigist Abera, Amit Kumar Sikder, Markus Miettinen, Hidayet Aksu, Mauro Conti, Ahmad-Reza Sadeghi, and A. Selcuk Uluagac. Peek-a-Boo: I see your smart home activities, even encrypted! arXiv preprint arXiv:1808.02741, 2018. · arXiv
- Giuseppe Aceto, Domenico Ciuonzo, Antonio Montieri, and Antonio Pescapé. Multi-Classification Approaches for Classifying Mobile App Traffic. Journal of Network and Computer Applications, 2018.
- Jagdish Prasad Achara, Gergely Acs, and Claude Castelluccia. On the Unicity of Smartphone Applications. In Proc. of the ACM Workshop on Privacy in the Electronic Society (WPES), 2015.
- Hasan Faik Alan and Jasleen Kaur. Can Android Applications Be Identified Using Only TCP/IP Headers of Their Launch Time Traffic? In Proc. of the ACM Conference on Security & Privacy in Wireless and Mobile Networks (WiSec), 2016.
- Blake Anderson and David McGrew. Identifying Encrypted Malware Traffic with Contextual Flow Data. In Proc. of the ACM Workshop on Artificial Intelligence and Security (AISec), 2016.
- Blake Anderson and David McGrew. TLS Beyond the Browser: Combining End Host and Network Data to Understand Application Behavior. In Proc. of the ACM Internet Measurement Conference (IMC), 2019.
- Blake Anderson, Subharthi Paul, and David McGrew. Deciphering Malware's use of TLS (without Decryption). Journal of Computer Virology and Hacking Techniques, 2018.
- Michael Backes, Sven Bugiel, and Erik Derr. Reliable Third-Party Library Detection in Android and its Security Applications. In Proc. of the ACM Conference on Computer and Communications Security (CCS), 2016.
- Taimur Bakhshi and Bogdan Ghita. On Internet Traffic Classification: A Two-Phased Machine Learning Approach. Journal of Computer Networks and Communications, 2016.
- Laurent Bernaille, Renata Teixeira, Ismael Akodkenou, Augustin Soule, and Kave Salamatian. Traffic Classification On The Fly. ACM SIGCOMM Computer Communication Review, 2006.
- Matthias Böhmer, Brent Hecht, Johannes Schöning, Antonio Krüger, and Gernot Bauer. Falling Asleep with Angry Birds, Facebook and Kindle -A Large Scale Study on Mobile Application Usage. In Proc. of the International Conference on Human-Computer Interaction with Mobile Devices and Services (MobileHCI), 2011.
- Riccardo Bortolameotti, Thijs van Ede, Marco Caselli, Maarten H Everts, Pieter Hartel, Rick Hofstede, Willem Jonker, and Andreas Peter. DECANTeR: DEteCtion of Anomalous outbouNd HTTP TRaffic by Passive Application Fingerprinting. In Proc. of the Annual Computer Security Applications Conference (ACSAC), 2017.
- Riccardo Bortolameotti, Thijs van Ede, Andrea Continella, Thomas Hupperich, Maarten Everts, Reza Rafati, Willem Jonker, Pieter Hartel, and Andreas Peter. HeadPrint: Detecting Anomalous Communications through Header-based Application Fingerprinting. In Proc. of the ACM Symposium on Applied Computing (SAC), 2020.
- Yi Chen, Wei You, Yeonjoon Lee, Kai Chen, XiaoFeng Wang, and Wei Zou. Mass Discovery of Android Traffic Imprints through Instantiated Partial Execution. In Proc. of the ACM Conference on Computer and Communications Security (CCS), 2017.
- Yi-Chao Chen, Yong Liao, Mario Baldi, Sung-Ju Lee, and Lili Qiu. OS Fingerprinting and Tethering Detection in Mobile Networks. In Proc. of the ACM Internet Measurement Conference (IMC), 2014.
- Zhengyang Chen, Bowen Yu, Yu Zhang, Jianzhong Zhang, and Jingdong Xu. Automatic Mobile Application Traffic Identifica- tion by Convolutional Neural Networks. In Proc. of IEEE Trust- com/BigDataSE/ISPA, 2016.
- Yeongrak Choi, Jae Yoon Chung, Byungchul Park, and James Won-Ki Hong. Automated classifier generation for application-level mobile traffic identification. In Proc. of the IEEE/IFIP Network Operations and Management Symposium (NOMS), 2012.
- Stefano Comino, Fabio M. Manenti, and Franco Mariuzzo. Updates Management in Mobile Applications. iTunes vs Google Play. Journal of Economics & Management Strategy, 2018.
- Mauro Conti, Luigi V. Mancini, Riccardo Spolaor, and Nino Vincenzo Verde. Can't You Hear Me Knocking: Identification of User Actions on Android Apps via Traffic Analysis. In Proc. of the ACM Conference on Data and Application Security and Privacy (CODASPY), 2015.
- Andrea Continella, Yanick Fratantonio, Martina Lindorfer, Alessan- dro Puccetti, Ali Zand, Christopher Kruegel, and Giovanni Vigna. Obfuscation-Resilient Privacy Leak Detection for Mobile Apps Through Differential Analysis. In Proc. of the ISOC Network and Distributed System Security Symposium (NDSS), 2017.
- Shuaifu Dai, Alok Tongaonkar, Xiaoyin Wang, Antonio Nucci, and Dawn Song. NetworkProfiler: Towards Automatic Fingerprinting of Android Apps. In Proc. of the IEEE International Conference on Computer Communications (INFOCOM), 2013.
- Zakir Durumeric, Zane Ma, Drew Springall, Richard Barnes, Nick Sullivan, Elie Bursztein, Michael Bailey, J Alex Halderman, and Vern Paxson. The Security Impact of HTTPS Interception. In Proc. of the ISOC Network and Distributed System Security Symposium (NDSS), 2017.
- David Formby, Preethi Srinivasan, Andrew Leonard, Jonathan Rogers, and Raheem Beyah. Who's in Control of Your Control System? Device Fingerprinting for Cyber-Physical Systems. In Proc. of the ISOC Network and Distributed System Security Symposium (NDSS), 2016.
- Frolov, Sergey and Wustrow, Eric. The use of TLS in Censorship Circumvention. In Proc. of the ISOC Network and Distributed System Security Symposium (NDSS), 2019.
- Julien Gamba, Mohammed Rashed, Abbas Razaghpanah, Juan Tapiador, and Narseo Vallina-Rodriguez. An Analysis of Pre-installed Android Software. In Proc. of the IEEE Symposium on Security and Privacy (S&P), 2020.
- Aric Hagberg, Daniel Schult, and Pieter Swart. Exploring Network Structure, Dynamics, and Function using NetworkX. In Proc. of the Python in Science Conference (SciPy), 2008.
- Tin Kam Ho. Random Decision Forests. In Proc. of IEEE International Conference on Document Analysis and Recognition (ICDAR), 1995.
- Martin Lastovicka, Tomas Jirsik, Pavel Celeda, Stanislav Spacek, and Daniel Filakovsky. Passive OS Fingerprinting Methods in the Jungle of Wireless Networks. In Proc. of the IEEE/IFIP Network Operations and Management Symposium (NOMS), 2018.
- Fangfan Li, Arian Akhavan Niaki, David Choffnes, Phillipa Gill, and Alan Mislove. A Large-Scale Analysis of Deployed Traffic Differenti- ation Practices. In Proc. of the ACM Special Interest Group on Data Communication (SIGCOMM), 2019.
- Li Li, Daoyuan Li, Tegawendé F. Bissyandé, Jacques Klein, Yves Le Traon, David Lo, and Lorenzo Cavallaro. Understanding Android App Piggybacking: A Systematic Study of Malicious Code Grafting. IEEE Transactions on Information Forensics and Security, 2017.
- Marc Liberatore and Brian Neil Levine. Inferring the Source of Encrypted HTTP Connections. In Proc. of the ACM Conference on Computer and Communications Security (CCS), 2006.
- Martina Lindorfer, Matthias Neugschwandtner, Lukas Weichselbaum, Yanick Fratantonio, Victor Van Der Veen, and Christian Platzer. An- drubis -1,000,000 Apps Later: A View on Current Android Malware Behaviors. In Proc. of the IEEE International Workshop on Building Analysis Datasets and Gathering Experience Returns for Security (BADGERS), 2014.
- Wes McKinney et al. Data Structures for Statistical Computing in Python. In Proc. of the Python in Science Conference (SciPy), 2010.
- Stanislav Miskovic, Gene Moo Lee, Yong Liao, and Mario Baldi. AppPrint: Automatic Fingerprinting of Mobile Applications in Network Traffic. In Proc. of the International Conference on Passive and Active Network Measurement (PAM), 2015.
- Ioannis Papapanagiotou, Erich M Nahum, and Vasileios Pappas. Con- figuring DHCP Leases in the Smartphone Era. In Proc. of the ACM Internet Measurement Conference (IMC), 2012.
- Fabian Pedregosa et al. Scikit-learn: Machine Learning in Python. Journal of Machine Learning Research, 2011.
- Emanuele Petagna, Giuseppe Laurenza, Claudio Ciccotelli, and Leonardo Querzoni. Peel the Onion: Recognition of Android Apps Behind the Tor Network. In Proc. of the International Conference on Information Security Practice and Experience (ISPEC), 2019.
- Lawrence R. Rabiner and Bernard Gold. Theory and Application of Digital Signal Processing. Prentice Hall, 1975.
- Abbas Razaghpanah, Arian Akhavan Niaki, Narseo Vallina-Rodriguez, Srikanth Sundaresan, Johanna Amann, and Phillipa Gill. Studying TLS Usage in Android Apps. In Proc. of the ACM International Conference on emerging Networking EXperiments and Technologies (CoNEXT), 2017.
- Jingjing Ren, Martina Lindorfer, Daniel Dubois, Ashwin Rao, David Choffnes, and Narseo Vallina-Rodriguez. Bug Fixes, Improvements, ... and Privacy Leaks -A Longitudinal Study of PII Leaks Across Android App Versions. In Proc. of the ISOC Network and Distributed System Security Symposium (NDSS), 2018.
- Jingjing Ren, Ashwin Rao, Martina Lindorfer, Arnaud Legout, and David Choffnes. ReCon: Revealing and Controlling PII Leaks in Mobile Network Traffic. In Proc. of the International Conference on Mobile Systems, Applications and Services (MobiSys), 2016.
- Andrew Rosenberg and Julia Hirschberg. V-Measure: A Conditional Entropy-Based External Cluster Evaluation Measure. In Proc. of the Joint Conference on Empirical Methods in Natural Language Process- ing and Computational Natural Language Learning (EMNLP-CoNLL), 2007.
- Brendan Saltaformaggio, Hongjun Choi, Kristen Johnson, Yonghwi Kwon, Qi Zhang, Xiangyu Zhang, Dongyan Xu, and John Qian. Eavesdropping on Fine-Grained User Activities Within Smartphone Apps Over Encrypted Network Traffic. In Proc. of the USENIX Workshop on Offensive Technologies (WOOT), 2016.
- Asaf Shabtai, Uri Kanonov, Yuval Elovici, Chanan Glezer, and Yael Weiss. "Andromaly": a behavioral malware detection framework for Android devices. Journal of Intelligent Information Systems, 2012.
- Tim Stöber, Mario Frank, Jens Schmitt, and Ivan Martinovic. Who do you sync you are? Smartphone Fingerprinting via Application Behaviour. In Proc. of the ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec), 2013.
- Vincent F. Taylor, Riccardo Spolaor, Mauro Conti, and Ivan Martinovic. AppScanner: Automatic Fingerprinting of Smartphone Apps from En- crypted Network Traffic. In Proc. of the IEEE European Symposium on Security and Privacy (EuroS&P), 2016.
- Eline Vanrykel, Gunes Acar, Michael Herrmann, and Claudia Diaz. Leaky Birds: Exploiting Mobile Application Traffic for Surveillance. In Proc. of the International Conference on Financial Cryptography and Data Security (FC), 2016.
- Antoine Vastel, Pierre Laperdrix, Walter Rudametkin, and Romain Rouvoy. FP-STALKER: Tracking Browser Fingerprint Evolutions. In Proc. of the IEEE Symposium on Security and Privacy (S&P), 2018.
- Nguyen Xuan Vinh, Julien Epps, and James Bailey. Information Theoretic Measures for Clusterings Comparison: Variants, Properties, Normalization and Correction for Chance. Journal of Machine Learning Research, 2010.
- Yong Wang, Jinpeng Wei, and Karthik Vangury. Bring Your Own Device Security Issues and Challenges. In Proc. of the IEEE Consumer Communications and Networking Conference (CCNC), 2014.
- Hongyi Yao, Gyan Ranjan, Alok Tongaonkar, Yong Liao, and Zhuo- qing Morley Mao. SAMPLES: Self Adaptive Mining of Persistent LExical Snippets for Classifying Mobile Application Traffic. In Proc. of the ACM Annual International Conference on Mobile Computing and Networking (MobiCom), 2015.
Cited by
Sorted by citations
Items 301–381 of 381
Echo-Traffic: Cross-Modal Feature Augmentation for Traffic Transformer Pre-Training
Feng, X., Gou, G., Dong, W., Jiang, X., Ding, Y., & Wang, X. (2026) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp55912.2026.11461226
A lightweight method for hidden camera detection and localization via air interface traffic analysis
Zhao, L., Li, S., Jiang, Z., Hu, Y., Li, R.-H., Yang, G., & Fu, J. (2026) · Discover Computing · doi:10.1007/s10791-026-10114-z
CTS-OD: a cascaded two-stage framework for high-throughput Obfs4 detection
Huang, Y., Zhang, Q., & Huang, C. (2026) · Cybersecur. · doi:10.1186/s42400-025-00492-0
An Enhanced Traffic Classifier Based on Self-Supervised Feature Learning
Jiang, S., Luo, X., Wang, H., Chen, G., & Zhao, H. (2026) · Applied Sciences · doi:10.3390/app16073493
A survey on network traffic analysis with incomplete data
Li, Z., Zhao, S., Chen, S., Wang, B., & Wang, M. (2026) · Computer Communications · doi:10.1016/j.comcom.2026.108478
Enhancing Fine-Grained Encrypted Traffic Classification via Temporal Bi-Directional GraphSAGE
Yang, J.-B., Shen, H.-H., Diao, Z.-L., & He, Y.-R. (2026) · Applied Sciences · doi:10.3390/app16073427
Li, Y.-C., & Tian, H. (2026) · 2026 IEEE 8th International Conference on Communications, Information System and Computer Engineering (CISCE) · doi:10.1109/cisce69494.2026.11504523
“FlowPrint [8] combines semi-supervised learning with session-level fingerprinting for mobile apps, and MaMPF [15] further enhances fingerprints via Markov-based joint transition modeling.”
Khesal, A. R., Abed, M., Mohammadi, M. M., Mahdavirad, M. M., Kabiri, R., & Teimouri, M. (2026) · Data in Brief · doi:10.1016/j.dib.2026.112731
Geng, J., Xie, Y., Li, J., Yu, X., & He, L. (2026) · Mathematics · doi:10.3390/math14030551 · Cited by 1
Zheng, C.-F., Ma, H.-L., Qu, Y., Jiang, Y., & Wang, W. (2026) · Comput. Networks · doi:10.1016/j.comnet.2026.112122
Zhang, Y., Wang, S., Chen, Z., & Yang, B. (2026) · Journal of Network and Systems Management · doi:10.1007/s10922-025-10011-8
Ran, P., Lei, M., & Yang, Y. (2025) · 2025 22nd International Computer Conference on Wavelet Active Media Technology and Information Processing (ICCWAMTIP) · doi:10.1109/iccwamtip68645.2025.11352597
NetGuard: Awareness of Network Access Behaviour via Real-Time Passive Traffic Analysis
Li, W.-H., Chen, J., Gou, W., Jin, H.-M., Wang, S., & Zhang, X.-Y. (2025) · Global Communications Conference · doi:10.1109/globecom59602.2025.11432783
Lightweight and Robust Encrypted Anomaly Traffic Detection Based on Improved CLT-BERT
Kong, F. (2025) · 2025 International Conference on Signal Processing, Computer Networks and Communications (SPCNC) · doi:10.1109/spcnc68200.2025.11406423
TrafficBM: A Dual-Modality Pre-Training Framework for Network Traffic Classification
Wang, M., Liao, J., Su, J., Wei, Z.-L., Chen, S., Li, Z., & Wang, B. (2025) · IEEE International Performance, Computing, and Communications Conference · doi:10.1109/ipccc66453.2025.11304658
“Traditional methods include FlowPrint [18], which uses protocol field fingerprints and performs well under light encryption, and AppScan-ner [19], which relies on handcrafted statistical features with Random Forest classifiers but is less robust in dynamic or heavily encrypted scenarios.”
Zhou, Y.-B., Shi, Y.-X., Yang, X., Xiao, D., Li, G., & Li, J.-H. (2025) · International Conference on Trust, Security and Privacy in Computing and Communications · doi:10.1109/trustcom66490.2025.00364
“Machine learning methods, such as AppScanner [2] and FlowPrint [3], rely on manually crafted features or flow fingerprints for classification.”
ETCFF: An Encrypted Traffic Classification Method Based on Fusion Features
Fu, Z.-P., & Zeng, F. (2025) · International Conference on Trust, Security and Privacy in Computing and Communications · doi:10.1109/trustcom66490.2025.00161
“Ede et al. proposed a mobile application identification method called FlowPrint, which combines destination-based clustering, browser isolation, and pattern recognition in a semi-supervised manner for application fingerprinting [5].”
Detection and Mitigation of Unknown Threats in IPv6 Networks via Layered Data Adaptation
Huang, Y.-J., Li, X., Zhang, J., & Duan, H.-X. (2025) · International Conference on Trust, Security and Privacy in Computing and Communications · doi:10.1109/trustcom66490.2025.00022
Gao, J.-Q., He, Y., Hao, Y., Han, D.-Q., Lu, Y., & Qiao, Y. (2025) · IEEE International Conference on Network Infrastructure and Digital Content · doi:10.1109/ic-nidc67200.2025.11390542
Scalable, Semi-supervised Mobile App Fingerprinting using LSH
Marzani, F., & Saleh, S. (2025) · Conference on Network and Service Management · doi:10.23919/cnsm67658.2025.11297519
“However, traditional inspection-based methods are no longer effective, as most mobile traffic is encrypted and lacks distinguishing payload content [2, 3].”
InfluentialLi, Z., Si, C.-X., & Cheng, Z. (2025) · ACM Multimedia · doi:10.1145/3746027.3755615
“Deep packet inspection solves the problem of variable port numbers by pattern matching on packets [4, 17, 44].”
SEAM: Semantic Similarity-Enhanced Adaptive Masking for Robust Encrypted Traffic Classification
Cui, S., Lu, Z., Liu, H., & Zhang, W. (2025) · 2025 6th International Conference on Computer Engineering and Intelligent Control (ICCEIC) · doi:10.1109/icceic67916.2025.11308209
An Efficient Encrypted Traffic Classification Method Using Mamba Architecture with MHSA Frontend
Fan, R.-P., & Wang, W. (2025) · 2025 6th International Conference on Computer Engineering and Intelligent Control (ICCEIC) · doi:10.1109/icceic67916.2025.11309076
Encrypted Network Traffic Feature Extraction for Application Classification
최양서, Yu, J., Koo, K., & Moon, D. (2025) · International Conference on Information and Communication Technology Convergence (ICTC) · doi:10.1109/ictc66702.2025.11388796 · Cited by 1
Liu, C.-H., Ding, X., Wang, L.-N., Pang, Z., Yang, C.-Y., Jia, B., & Yu, R. (2025) · IEEE International Conference on Systems, Man and Cybernetics · doi:10.1109/smc58881.2025.11343440
Ponraj, R., Durairajan, R., & Wang, Y. (2025) · Knowledge Discovery and Data Mining · doi:10.1145/3770854.3783939
“Although earlier feature-engineering-based traffic classifiers, such as fingerprint matching [40, 42], are inherently explainable by manually extracting features (e.g., device and certificate) based on domain expertise, they are less effective and nonadaptive.”
InfluentialGeneralized Encrypted Traffic Classification Using Inter-flow Signals
Bianchi, F., Paolo, E. D., & Spognardi, A. (2025) · ARES · doi:10.1007/978-3-032-00624-0_11
“FlowPrint [25] analyzed temporal correlations among destination-related features of network traffic at the inter-flow level and created a database of application-specific fingerprints.”
InfluentialMS-PreTE: A Multi-Scale Pre-Training Encoder for Mobile Encrypted Traffic Classification
Wang, Z., Qiu, Y., Liu, Y., Zhang, S., & Liu, X. (2025) · Big Data and Cognitive Computing · doi:10.3390/bdcc9080216 · Cited by 2
Zhan, X., Li, N., Li, M., & Liu, C. (2025) · IEEE International Conference on High Performance Computing and Communications · doi:10.1109/hpcc67675.2025.00126
Yang, H., Chen, W., Chen, W., Wang, S., Li, P., & Tian, Y. (2025) · IEEE International Conference on Privacy Computing and Data Security (PCDS) · doi:10.1109/pcds65695.2025.00045 · Cited by 1
Physical layer features based mobile encrypted traffic classification
Mei, W.-M., Meng, X., Tang, Y.-Z., Ji, F., Gao, Z., & Zhou, Y. (2025) · International Conference on Signal Processing, Communication and Control Systems (SPCCS 2025) · doi:10.1117/12.3070529
“Most of these works were completed through supervised learning [14], only a few work accomplished with semi-supervised or unsupervised learning methods[15].”
MTDIR: A Malicious Traffic Detection Model Based on the Image Retrieval Perspective
Li, Z., He, H., Zhou, Z., & Si, C.-X. (2025) · International Conference on Multimedia Retrieval · doi:10.1145/3731715.3733398
“Deep packet inspection solves the problem of variable port numbers by pattern matching on packets [4, 13, 34].”
BACKTRACKER: A Novel Background Traffic Identification System For Mobile Apps
Liu, Y., Cai, Y., Li, S., Zhang, H.-F., Yang, R., & Liu, Q.-Y. (2025) · IEEE International Joint Conference on Neural Network · doi:10.1109/ijcnn64981.2025.11229248
“Metadata-based methods, like Flowprint [10], use destination IP clusters for app fingerprinting.”
Efficient Encrypted Traffic Classification with Multiple Knowledge Distillation
Yang, G.-Z., Chen, Z.-L., & Song, Z.-J. (2025) · IEEE International Joint Conference on Neural Network · doi:10.1109/ijcnn64981.2025.11227284
Encrypted Traffic Classification with Graph Sketch-Based Traffic Representation
Yu, S., Li, D., Guo, Y.-X., Xie, R., & Zhang, Y. (2025) · IEEE International Joint Conference on Neural Network · doi:10.1109/ijcnn64981.2025.11228514
HC-MVGAE: An Encrypted Traffic Classification Method Based on Contrastive Learning
Peng, Y., Han, Y.-L., Wu, X., & Li, Y. (2025) · 2025 10th International Conference on Electronic Technology and Information Science (ICETIS) · doi:10.1109/icetis66286.2025.11144428
Mirage: Real-Time Network Traffic Evasion with Deep Reinforcement Learning
Li, W.-H., Zou, J., Li, Z.-X., Jin, H.-M., Wang, S., & Zhang, X.-Y. (2025) · ICC 2025 - IEEE International Conference on Communications · doi:10.1109/icc52391.2025.11161580
“Our experimental evaluation measures the effects of perturbations on four statistical analyzers—Random Forest [19], KNN [20], SVM [21], XGBoost [22]—and four non-statistical analyzers, including FC-Net [23], FlowPrint [24], FS-Net [25], and MB-Tree [26].”
Collaborative Countermeasure Against Network Traffic Analyses Based on Packet Aggregation
Spolaor, R., Shi, H., Gaspari, F. D., Mancini, L. V., Yu, D., & Cheng, X.-Z. (2025) · ICC 2025 - IEEE International Conference on Communications · doi:10.1109/icc52391.2025.11160961
“NTA has been leveraged to infer traffic characteristics [6], operating system and browser used by the communication endpoints [7], installed mobile applications [8], [9], user actions [10], [11], and browsed websites [12].”
A Malicious Traffic Detection Method Based on 1D ConvNeXt and Multi-Scale Patches
Wang, M., Zhang, Y., Li, H., Zhou, X., & Ren, Y. (2025) · IEEE/IFIP Network Operations and Management Symposium (NOMS) · doi:10.1109/noms57970.2025.11073672 · Cited by 1
“Van et al. [10] propose the FlowPrint model, which generates traffic fingerprints by analyzing attributes such as packet size, intervals, and direction, and uses these fingerprints to identify different types of network activities, including malicious and normal traffic.”
InfluentialNTFR: A Network Traffic Feature Reduction Method Based on Relational Analysis
Gao, X., Lu, B., Zhao, B., & Meng, L. (2025) · International Conference Civil Engineering and Architecture · doi:10.1109/iccea65460.2025.11102397
ANT-ET: An end-to-end multimodal framework for fine-grained encrypted traffic fingerprinting
Kong, H., Yang, L., Ge, J., Li, T., & Li, H. (2025) · Journal of Computer Security · doi:10.1177/0926227x251325484
Enhanced Encrypted Traffic Classification Through Packet-Flow Dual Views
Feng, B., Wang, Q., Wang, Y.-J., Li, F., Xu, X., Zang, T., & Ma, J. (2025) · IEEE Wireless Communications and Networking Conference · doi:10.1109/wcnc61545.2025.10978498
Liu, Y. R., Sang, G., Li, B., Wang, T., & Wu, W. (2024) · International Conference on Mobility, Sensing and Networking (MSN) · doi:10.1109/msn63567.2024.00109
SCENE: Shape-based Clustering for Enhanced Noise-resilient Encrypted Traffic Classification
Du, M., Hu, M., Li, S., Li, Z., & Liu, Q. (2024) · International Conference on Trust, Security and Privacy in Computing and Communications · doi:10.1109/trustcom63139.2024.00064
“Semi-supervised methods combine the strengths of supervised and unsupervised learning by training models with a small amount of labeled data and a large amount of unlabeled data [30].”
ET-SSM: Linear-Time Encrypted Traffic Classification Method Based On Structured State Space Model
Li, Y., Zhao, X., Zha, Z., & Ling, Z.-H. (2024) · Asia-Pacific Signal and Information Processing Association Annual Summit and Conference (APSIPA ASC) · doi:10.1109/apsipaasc63619.2025.10849155
“We evaluate and compare the performance of our model using four typical metrics: Accuracy (AC), Precision (PR), Recall (RC), and F1 Score (F1), as described in [27], [28].”
Liu, K., Wang, F., & Chen, S.-H. (2024) · International Symposium on Image and Signal Processing and Analysis · doi:10.1109/ispa63168.2024.00291
CMAE-MTC: A Contextual Masked AutoEncoder Based Multi-Level Traffic Classifier
Yuan, Z., Luo, M., Peng, C., & Liu, Q. (2024) · IEEE International Symposium on Parallel and Distributed Processing with Applications (ISPA) · doi:10.1109/ispa63168.2024.00147 · Cited by 2
Dual Feature Extraction and Fusion for Malicious Traffic Detection based Transformer Encoders
Xu, G., Huang, Y., & Han, X. (2024) · 2024 5th International Conference on Big Data & Artificial Intelligence & Software Engineering (ICBASE) · doi:10.1109/icbase63199.2024.10762035
Divide-and-Conquer Based Traffic Classification: Towards A Cascaded Classifier
Liu, Y., Liu, Z., & Zeng, Y. (2024) · International Conference on Networking and Network Applications (NaNA) · doi:10.1109/nana63151.2024.00085
“FlowPrint [15] takes into account the spatial correlations between mobile applications’ flows and combines them with mobile application traffic patterns to achieve accurate classification and fingerprinting of encrypted network traffic from mobile applications.”
BackgroundZhang, Y., Jia, Z.-H., Huang, X.-H., Wang, J.-J., Zhou, G., Shi, F., & Lu, C. (2024) · International Conference on Image Processing and Artificial Intelligence · doi:10.1117/12.3035287
“We compare FM-ENet with various methods, including (1) fingerprint construction method: FlowPrint [7] ;(2) statistical feature methods: AppScanner [8] ; (3) deep learning methods: TSCRNN [9] ; (4) pre-training method: PERT [10] .”
Li, S.-B., Lv, Z., Zang, T., Yang, L., & Qiang, Q. (2024) · IEEE International Joint Conference on Neural Network · doi:10.1109/ijcnn60899.2024.10650862
“In [5], a semi-supervised app fingerprinting method is proposed, which is able to automatically find temporal correlations of traffic flows and generate app fingerprints.”
MethodMa, M.-H., Shi, Z., Yin, Q., & Zong, Y. (2024) · International Symposium on Computers and Communications · doi:10.1109/iscc61673.2024.10733622
“For example, some works utilize statistical information for traffic fingerprint generation [5], [6].”
BackgroundMethodFirst Steps Towards Game and Activity Inference on Encrypted VR Datastreams
Yang, Y.-S., Hanisch, S., Ma, M.-Y., Roos, S., Strufe, T., & Nguyen, G. T. (2024) · IEEE International Symposium on a World of Wireless, Mobile and Multimedia Networks · doi:10.1109/wowmom60985.2024.00030
“During the last years, a considerable number of research work focused on website and application fingerprinting, i.e., understanding their traffic characteristics, e.g., see [5]–[8], and the references therein.”
BackgroundIMTCDF: A Multi-Module-Based Internet Malicious Traffic Classification and Detection Framework
Li, Z., Xu, J., Cheng, Z., & Zang, T. (2024) · International Conference on Computer Supported Cooperative Work in Design · doi:10.1109/cscwd61410.2024.10579986
“Ede et al. [15] proposed a traffic fingerprint extraction method.”
MethodZhou, B., & Huang, Y. (2024) · IEEE Advanced Information Technology, Electronic and Automation Control Conference (IAEAC) · doi:10.1109/iaeac59436.2024.10503735
“By comparison, FlowPrint [7] utilises unencrypted protocol field data, such as size, certificate, device, and time characteristics, to represent each flow.”
BackgroundMethodSeqnature: Extracting Network Fingerprints from Packet Sequences
Varmarken, J., Trimananda, R., & Markopoulou, A. (2023) · arXiv.org · doi:10.48550/arxiv.2312.17370
“Some have explored techniques to fingerprint websites protected by various privacy enhancing technologies [9, 18, 29, 36, 37, 49, 50], and desktop [6] and mobile [52, 53, 56] applications have also been finger-printed.”
BackgroundVT-Scanner: Layout Similarity on Smartphone and Its Application for Robust Scene Recognition
Zhu, J., Wang, L., Xin, T., & Qin, X.-W. (2023) · International Conference on Wireless Communications and Signal Processing · doi:10.1109/wcsp58612.2023.10404697
“However, there are still challenges including biased information (IPs or ports) [12], public code base, and zero-day applications [4].”
BackgroundMethodNetwork traffic classification based on multi-head attention and deep metric learning
Lv, Z.-H., Lu, B., Li, X., & Qi, Z. (2023) · International Conference on Electronic Technology and Information Science · doi:10.1117/12.2682521
“We used three publicly available encrypted traffic data sets, Cross-Platform[7], USTC-TFC2016[8], and ETC[9].”
MethodPacket Chunking for File Detection
Hur, J., Shon, H., Kim, Y. J., & Yoon, M. (2023) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2022.3215549
“Researchers study decryption boxes [26] or encrypted packet analysis [27], [28].”
BackgroundGao, L., Zeng, M., & Huang, Z.-H. (2023) · arXiv.org · doi:10.48550/arxiv.2302.03118
“The code is adapted from the partial implementation of FlowPrint [27], which implements the Single Large Random Forest Classifier of AppScanner [28].”
MethodHigh-Efficient and Few-shot Adaptive Encrypted Traffic Classification with Deep Tree
Wang, Q., Li, W., Bao, H.-F., Tang, Z., Wang, W., Liu, F., & Ying, L. (2022) · IEEE Military Communications Conference · doi:10.1109/milcom55135.2022.10017968
“The baseline methods include machine learning based [27] [28], network-fingerprint based [20] [21], neuralnetwork-based [23] [13] [12] [25], and so on.”
MethodFast and Robust Online Traffic Classification Supporting Unseen Applications
Gu, Y., Li, D., Gao, K., & Cheng, Y. (2021) · Global Communications Conference · doi:10.1109/globecom46510.2021.9685631
“Second, while the traffic categories may be fixed ( 6 categories in this paper) in the online environment, unseen applications are constantly emerging [5].”
BackgroundAirCloak: An App-Transparent Traffic Cloaking Middleware Against Wireless Fingerprinting Attack
Bian, H.-F., Li, J.-F., Luo, H., Liu, Y., Ma, X.-B., Li, Z., Zhang, J.-L., Wang, J.-G., & Wang, W. (2026) · IEEE Transactions on Networking · doi:10.1109/ton.2026.3705510
“Such attacks [1], [2], [3], [4], [5], [6], [7], [8], [9], [10], [11], [12] can accurately identify app types and infer privacy-sensitive behaviors (e.g., video calls and financial transactions), thereby posing significant threats to user privacy.”
InfluentialHuang, Y., Wang, X., & He, M. (2026) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2026.3725912
“FlowPrint [15] is a representative semi-supervised method for mobile-app fingerprinting on encrypted traffic.”
InfluentialOnline Traffic Camouflage Against Network Analyzers via Deep Reinforcement Learning
Li, W.-H., Chen, J., Li, Z.-X., Wang, S., Jin, H.-M., & Zhang, X.-Y. (2026) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2025.3646259
“2) FlowPrint [29]: A fingerprint-based model that combines lightweight structural features (e.g., message type sequences, certificate information) and minimal statistical attributes (e.g., burst packet count).”
Zhu, X., Wang, J., Ge, W., & Han, X. (2026) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2026.3664007 · Cited by 1
“Subsequently, statistical feature-based methods extract tra ffi c features, such as packet lengths and inter-arrival times, to enhance classification performance [7], [8], [9], [10], [11].”
Encrypted Traffic Classification Based on Two-Phase Feature Fusion
Tan, X.-B., Huang, C., Wang, H., Chen, S.-W., & Zheng, Q. (2026) · IEEE Transactions on Cognitive Communications and Networking · doi:10.1109/tccn.2026.3683889
NT-Transformer: A Non-Pretrained Encrypted Network Traffic Classification Model
Yan, Z., Peng, L., Liu, P., Bao, Y., & Yang, B. (2026) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2026.3683410
“Unlike traditional DPI-based methods that can raise privacy concerns and fail when being applied to encrypted traffic, FlowPrint [19] introduces a semi-supervised approach for constructing mobile app fingerprints by combining temporal, device, destination, and packet size features, without inspecting…”
Task-Dependent Effectiveness of QKS-Inspired Random Features in Network Traffic Classification
Yefet, Y., Danilchenko, K., & Stulman, A. (2026) · IEEE Access · doi:10.1109/access.2026.3689396
Liu, T., Fu, Y., An, Y., & Ma, M. (2026) · Information Sciences · doi:10.1016/j.ins.2026.123646
Han, X.-Y., Qin, J., Zhao, C., Fang, W., Liu, J., Wang, W., Jiang, B.-S., Cui, S., Lu, Z.-G., & Liu, B.-X. (2026) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2026.3694664
“There are also semi-supervised methods [31], [44], which typically use only a small amount of labeled data, leveraging the distributional characteristics of unlabeled data to assist in classification.”
Hu, Y., Deng, T., Song, J., Fan, P., & Zhou, X. (2026) · IEEE Transactions on Cognitive Communications and Networking · doi:10.1109/tccn.2026.3695843
“(3) We selected the Cross-Platform(IOS) and Cross-Platform(Android) open-source datasets [28]; these datasets were created from the top 100 applications from software stores in the US, China, and India, with each application running for three to ten minutes while receiving real user input.”
SRViT: A Robust Online Encrypted Traffic Classification Based on Vision Transformer
Liu, C., Han, L., Diao, Z.-L., Wu, Z., He, X., Fan, W.-B., & Xiao, F. (2026) · IEEE Transactions on Networking · doi:10.1109/ton.2026.3699540
“For example, FlowPrint [15] extracts the device, certificate, size, and temporal features from the header field of each packet to make the representation of each flow and then constructs a fingerprint database.”
DVG-GNN: Dual-View Graph Representation Learning for Encrypted Traffic Classification
Yang, G., Wang, H., Wang, Y., Liu, W., & Chen, B. (2026) · Computers, Materials & Continua · doi:10.32604/cmc.2026.083419
Graph-Based Contrastive Learning and Clustering for Open-World Encrypted Traffic Classification
Wen, J., Zhang, X., Xie, K., Zeng, Y., Huang, K., Ouyang, Y., & Liang, W. (2026) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2026.3705313
“…on the APPLI-CATIONS 21 dataset by removing three application classes from the training set (treated as new classes during testing), and compared GCLC with FlowPrint [30] and Velatin [11], the two models capable of handling open-world scenarios, in terms of new tra ffi c identification performance.”
UTFormer: An Ultra-Lightweight Transformer for Traffic Classification
Wen, D., Li, T., Fan, Z., Li, Q., Li, J., Zhu, F., Li, C., Vasilakos, A. V., & Li, T. (2026) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2026.3711855
“• Cross-platform-iOS [35]: The dataset collects encrypted app-level tra ffi c from the 167 most popular applications on iOS.”
GraphWave: A Dynamic Context-Adaptive Multimodal Feature Fusion Framework for Threat Detection
Fang, P., Zhao, Z.-M., Huang, F.-Y., Zhang, F., & Lu, J.-R. (2026) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2026.3723120
“This is larger than that of the machine-learning based methods (FlowPic [39], FlowLens [15], FlowPrint [68], nPrintML [17], Whisper [22], HyperVi-sion [24]) 2 and on a par with the deep-learning based methods (Trident [14], Tra ffi cScope [3]).”
Zhan, M., Zhao, R., Deng, X., Xue, Z., Li, Q. L., Liu, Z., Cheng, G., & Xu, K. (2026) · IEEE Transactions on Networking · doi:10.1109/ton.2026.3739909
“A. Experiment Settings 1) Datasets: We conduct our experiments on six traffic datasets: ISCXVPN [48], CrossPlatform [49], USTC-TFC [17], Malware [50], CICIDS2017 [51], and RealNetwork [52], covering different traffic scenarios.”
NestTor: Detecting Tor-Over-Proxy Traffic With Factorized Decisions
Zhou, C.-X., Huang, C., Zhang, Q., Xie, Q.-L., & Li, Z.-Q. (2026) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2026.3743261
“Statistical and correlation-based representations support application and security classification using flow measurements and traffic relationships [18], [19], [20], [21], [22].”
Enhancing the Security of One-Tap Authentication Services via Dynamic Application Identification
Liu, D., Li, D.-W., Guo, Y.-X., Guo, Y., Hu, R., Liu, J., Bian, S., Ding, X., Liu, Y.-Z., & Guan, Z.-Y. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3607232
“These techniques typically identify applications by capturing TCP / IP tra ffi c [19] or eavesdropping on 802.11 wireless frames [17].”
InfluentialEncrypted Traffic Classification Based on Multi-Stage Neural Networks
刘, 亚. (2024) · Modeling and Simulation · doi:10.12677/mos.2024.133215
Metadata
- Authors
- van Ede, T., Bortolameotti, R., Continella, A., Ren, J., Dubois, D. J., Lindorfer, M., Choffnes, D., van Steen, M., & Peter, A.
- Affiliations
- University of Twente (NL)
- University of California, Santa Barbara (US)
- Northeastern University (US)
- TU Wien (AT)
- ORCID
- Venue
- Proceedings 2020 Network and Distributed System Security Symposium
- Publisher
- Internet Society
- Published
- 2020
- OpenAlex
- W3007562398
- Cited by
- 339
- References
- 51
- Citations by year
- 2026: 66 · 2025: 92 · 2024: 72 · 2023: 49 · 2022: 38 · 2021: 18 · 2020: 4
- FWCI
- 10.41
- Type
- conference paper
- Language
- en
- Open access
- bronze
- doi.org
- Locations
- Network and Distributed System Security Symposium (publishedVersion)
- University of Twente Research Information (publishedVersion, other-oa)
- University of Twente Research Information (submittedVersion, other-oa)
- Funders
- National Science Foundation (1909020)
- Österreichische Nationalstiftung für Forschung, Technologie und Entwicklung
- Comcast Innovation Fund
- Nederlandse Organisatie voor Wetenschappelijk Onderzoek
- Bundesministerium für Verkehr, Innovation und Technologie
- Christian Doppler Forschungsgesellschaft
- Bundesministerium für Digitalisierung und Wirtschaftsstandort
- SBA Research
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Physical Sciences › Computer Science › Information Systems › Mobile and Web Applications
- Physical Sciences › Computer Science › Software › Advanced Malware Detection Techniques
- Keywords
- encrypted traffic, semi-supervised learning, temporal correlation, Android, iOS, network traffic analysis
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
