Mobile app identification for encrypted network flows by traffic correlation
Mobile application (simply “app”) identification at a per-flow granularity is vital for traffic engineering, network management, and security practices. However, uncertainty is caused by a growing fraction of encrypted traffic such as Hypertext Transfer Protocol Secure. To address this challenge, we...
| Main Authors: | , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Hindawi - SAGE Publishing
2018-12-01
|
| Series: | International Journal of Distributed Sensor Networks |
| Online Access: | https://doi.org/10.1177/1550147718817292 |
| _version_ | 1797721845380677632 |
|---|---|
| author | Gaofeng He Bingfeng Xu Lu Zhang Haiting Zhu |
| author_facet | Gaofeng He Bingfeng Xu Lu Zhang Haiting Zhu |
| author_sort | Gaofeng He |
| collection | DOAJ |
| description | Mobile application (simply “app”) identification at a per-flow granularity is vital for traffic engineering, network management, and security practices. However, uncertainty is caused by a growing fraction of encrypted traffic such as Hypertext Transfer Protocol Secure. To address this challenge, we have carefully analyzed mobile app traffic (mainly including Domain Name System, Hypertext Transfer Protocol, and encrypted traffic such as Secure Sockets Layer and Transport Layer Security) and observed that (1) the sets of server hostnames queried by different apps are distinguishable; (2) mobile apps may query multiple server hostnames simultaneously, that is, apps may send several Domain Name System lookups within a short time interval; and (3) the encrypted traffic may be similar to various other network flows generated by the same app. Based on these three observations, in this article, we propose a novel app identification methodology for encrypted network flows. To be specific, temporal, lexical, and metadata similarity are investigated to select correlated traffic and information retrieving techniques are adopted to identify apps. We ran a thorough set of experiments to assess the performance of the proposed approaches. The experimental results show that the identification accuracy can be as high as 95%, and the proposed methods have low storage requirements as well as fast training speeds. |
| first_indexed | 2024-03-12T09:40:02Z |
| format | Article |
| id | doaj.art-5a5acbfb927044c4b6023ce15609d891 |
| institution | Directory Open Access Journal |
| issn | 1550-1477 |
| language | English |
| last_indexed | 2024-03-12T09:40:02Z |
| publishDate | 2018-12-01 |
| publisher | Hindawi - SAGE Publishing |
| record_format | Article |
| series | International Journal of Distributed Sensor Networks |
| spelling | doaj.art-5a5acbfb927044c4b6023ce15609d8912023-09-02T13:20:35ZengHindawi - SAGE PublishingInternational Journal of Distributed Sensor Networks1550-14772018-12-011410.1177/1550147718817292Mobile app identification for encrypted network flows by traffic correlationGaofeng He0Bingfeng Xu1Lu Zhang2Haiting Zhu3College of Internet of Things, Nanjing University of Posts and Telecommunications, Nanjing, ChinaCollege of Information Science and Technology, Nanjing Forestry University, Nanjing, ChinaCollege of Information Engineering, Nanjing University of Finance and Economics, Nanjing, ChinaCollege of Internet of Things, Nanjing University of Posts and Telecommunications, Nanjing, ChinaMobile application (simply “app”) identification at a per-flow granularity is vital for traffic engineering, network management, and security practices. However, uncertainty is caused by a growing fraction of encrypted traffic such as Hypertext Transfer Protocol Secure. To address this challenge, we have carefully analyzed mobile app traffic (mainly including Domain Name System, Hypertext Transfer Protocol, and encrypted traffic such as Secure Sockets Layer and Transport Layer Security) and observed that (1) the sets of server hostnames queried by different apps are distinguishable; (2) mobile apps may query multiple server hostnames simultaneously, that is, apps may send several Domain Name System lookups within a short time interval; and (3) the encrypted traffic may be similar to various other network flows generated by the same app. Based on these three observations, in this article, we propose a novel app identification methodology for encrypted network flows. To be specific, temporal, lexical, and metadata similarity are investigated to select correlated traffic and information retrieving techniques are adopted to identify apps. We ran a thorough set of experiments to assess the performance of the proposed approaches. The experimental results show that the identification accuracy can be as high as 95%, and the proposed methods have low storage requirements as well as fast training speeds.https://doi.org/10.1177/1550147718817292 |
| spellingShingle | Gaofeng He Bingfeng Xu Lu Zhang Haiting Zhu Mobile app identification for encrypted network flows by traffic correlation International Journal of Distributed Sensor Networks |
| title | Mobile app identification for encrypted network flows by traffic correlation |
| title_full | Mobile app identification for encrypted network flows by traffic correlation |
| title_fullStr | Mobile app identification for encrypted network flows by traffic correlation |
| title_full_unstemmed | Mobile app identification for encrypted network flows by traffic correlation |
| title_short | Mobile app identification for encrypted network flows by traffic correlation |
| title_sort | mobile app identification for encrypted network flows by traffic correlation |
| url | https://doi.org/10.1177/1550147718817292 |
| work_keys_str_mv | AT gaofenghe mobileappidentificationforencryptednetworkflowsbytrafficcorrelation AT bingfengxu mobileappidentificationforencryptednetworkflowsbytrafficcorrelation AT luzhang mobileappidentificationforencryptednetworkflowsbytrafficcorrelation AT haitingzhu mobileappidentificationforencryptednetworkflowsbytrafficcorrelation |