FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic

Abstract

Mobile-application fingerprinting of network traffic is valuable for many security solutions as it provides insights into the apps active on a network. Unfortunately, existing techniques require prior knowledge of apps to be able to recognize them. However, mobile environments are constantly evolving, i.e., apps are regularly installed, updated, and uninstalled. Therefore, it is infeasible for existing fingerprinting approaches to cover all apps that may appear on a network. Moreover, most mobile traffic is encrypted, shows similarities with other apps, e.g., due to common libraries or the use of content delivery networks, and depends on user input, further complicating the fingerprinting process. As a solution, we propose FLOWPRINT, a semi-supervised approach for fingerprinting mobile apps from (encrypted) network traffic. We automatically find temporal correlations among destination-related features of network traffic and use these correlations to generate app fingerprints. Our approach is able to fingerprint previously unseen apps, something that existing techniques fail to achieve. We evaluate our approach for both Android and iOS in the setting of app recognition, where we achieve an accuracy of 89.2%, significantly outperforming stateof-the-art solutions. In addition, we show that our approach can detect previously unseen apps with a precision of 93.5%, detecting 72.3% of apps within the first five minutes of communication.

A Survey on Encrypted Network Traffic Analysis Applications, Techniques, and Countermeasures

“…Many works have proposed a number of methods to identify the application associated with a traffic flow [79,103]. [31] Android application classification 2016 Taylor et al [146] Android application classification 2016 Lopez et al [94] IoT traffic classification 2017 Taylor et al [147] Android application classification 2018 Aceto et al [26] Mobile application classification 2018 Aceto et al [27] Mobile application classification 2019 Aiolli et al [30] Identification of user activities on smartphone-based Bitcoin wallet apps 2019 Yao et al [168] IoT traffic classification 2019 Ede et al [151] Mobile application classification 2020 Coull et al [54] Application Usage Identification however, assuming unencrypted packet payloads is not a realistic scenario in the present. The research community has investigated other ways to extract meaningful, side-channel information (packet-or network-level) that is able to be expressed into signatures.…”

“…Their proposed work eliminates the process of manually selecting traffic features. FLOWPRINT [151] offers mobile application identification by analyzing the network traffic. It introduces an approach for application fingerprinting by combining destination-based clustering, browser isolation, and pattern recognition (in a semi-supervised manner).…”

“…In the category of application identification and classification, Yao et al [168] used the USTC-TFC2016 dataset [12] that among others contains network traffic from BitTorrent, Facetime, Gmail, and Skype. Ede et al [151] used the Recon dataset [14], which consists of labeled network traces of 512 Android apps from the Google Play Store, including multiple versions for over a period of 8 years.…”

MAppGraph: Mobile-App Classification on Encrypted Network Traffic using Deep Graph Convolution Neural Networks

“…For instance, AppScanner [40] used a flow-based detection approach that extracts side-channel features from the packet header and computes statistical features to train a machine learning model for mobile app classification. As apps use CDNs or shared services, similar flow characteristics will be observed, thus confusing the classification model [40,41,44]. Examples of shared services include crash analytics, mobile advertisement (ad) networks, social networks.…”

“…These services are often embedded through libraries that are used by many apps: e.g., googleads.g.doubleclick.net, lh4.googleusercontent.com and android.clients.google.com. Motivated by this issue, the authors of FlowPrint [44] proposed to construct the fingerprint of an app by considering the communication graph between the mobile device and other destinations (e.g., CDNs and third-party services) and the associated attributes such as destination IP, destination port and TLS-certificates. At the inference stage, the fingerprint collected in the past is compared with the new one to determine the app.…”