Robust smartphone app identification via encrypted network traffic analysis
The apps installed on a smartphone can reveal much information about a user, such as their medical conditions, sexual orientation, or religious beliefs. In addition, the presence or absence of particular apps on a smartphone can inform an adversary, who is intent on attacking the device. In this pap...
| Main Authors: | , , , |
|---|---|
| Format: | Journal article |
| Published: |
Institute of Electrical and Electronics Engineers
2017
|
| _version_ | 1797059541042462720 |
|---|---|
| author | Taylor, V Spolaor, R Conti, M Martinovic, I |
| author_facet | Taylor, V Spolaor, R Conti, M Martinovic, I |
| author_sort | Taylor, V |
| collection | OXFORD |
| description | The apps installed on a smartphone can reveal much information about a user, such as their medical conditions, sexual orientation, or religious beliefs. In addition, the presence or absence of particular apps on a smartphone can inform an adversary, who is intent on attacking the device. In this paper, we show that a passive eavesdropper can feasibly identify smartphone apps by fingerprinting the network traffic that they send. Although SSL/TLS hides the payload of packets, sidechannel data, such as packet size and direction is still leaked from encrypted connections. We use machine learning techniques to identify smartphone apps from this side-channel data. In addition to merely fingerprinting and identifying smartphone apps, we investigate how app fingerprints change over time, across devices, and across different versions of apps. In addition, we introduce strategies that enable our app classification system to identify and mitigate the effect of ambiguous traffic, i.e., traffic in common among apps, such as advertisement traffic. We fully implemented a framework to fingerprint apps and ran a thorough set of experiments to assess its performance. We fingerprinted 110 of the most popular apps in the Google Play Store and were able to identify them six months later with up to 96% accuracy. Additionally, we show that app fingerprints persist to varying extents across devices and app versions. |
| first_indexed | 2024-03-06T20:05:45Z |
| format | Journal article |
| id | oxford-uuid:28d972cf-3c55-4448-aae9-ec2a0865dfff |
| institution | University of Oxford |
| last_indexed | 2024-03-06T20:05:45Z |
| publishDate | 2017 |
| publisher | Institute of Electrical and Electronics Engineers |
| record_format | dspace |
| spelling | oxford-uuid:28d972cf-3c55-4448-aae9-ec2a0865dfff2022-03-26T12:15:30ZRobust smartphone app identification via encrypted network traffic analysisJournal articlehttp://purl.org/coar/resource_type/c_dcae04bcuuid:28d972cf-3c55-4448-aae9-ec2a0865dfffSymplectic Elements at OxfordInstitute of Electrical and Electronics Engineers2017Taylor, VSpolaor, RConti, MMartinovic, IThe apps installed on a smartphone can reveal much information about a user, such as their medical conditions, sexual orientation, or religious beliefs. In addition, the presence or absence of particular apps on a smartphone can inform an adversary, who is intent on attacking the device. In this paper, we show that a passive eavesdropper can feasibly identify smartphone apps by fingerprinting the network traffic that they send. Although SSL/TLS hides the payload of packets, sidechannel data, such as packet size and direction is still leaked from encrypted connections. We use machine learning techniques to identify smartphone apps from this side-channel data. In addition to merely fingerprinting and identifying smartphone apps, we investigate how app fingerprints change over time, across devices, and across different versions of apps. In addition, we introduce strategies that enable our app classification system to identify and mitigate the effect of ambiguous traffic, i.e., traffic in common among apps, such as advertisement traffic. We fully implemented a framework to fingerprint apps and ran a thorough set of experiments to assess its performance. We fingerprinted 110 of the most popular apps in the Google Play Store and were able to identify them six months later with up to 96% accuracy. Additionally, we show that app fingerprints persist to varying extents across devices and app versions. |
| spellingShingle | Taylor, V Spolaor, R Conti, M Martinovic, I Robust smartphone app identification via encrypted network traffic analysis |
| title | Robust smartphone app identification via encrypted network traffic analysis |
| title_full | Robust smartphone app identification via encrypted network traffic analysis |
| title_fullStr | Robust smartphone app identification via encrypted network traffic analysis |
| title_full_unstemmed | Robust smartphone app identification via encrypted network traffic analysis |
| title_short | Robust smartphone app identification via encrypted network traffic analysis |
| title_sort | robust smartphone app identification via encrypted network traffic analysis |
| work_keys_str_mv | AT taylorv robustsmartphoneappidentificationviaencryptednetworktrafficanalysis AT spolaorr robustsmartphoneappidentificationviaencryptednetworktrafficanalysis AT contim robustsmartphoneappidentificationviaencryptednetworktrafficanalysis AT martinovici robustsmartphoneappidentificationviaencryptednetworktrafficanalysis |