Large-Scale Mobile App Identification Using Deep Learning

Abstract

Many network services and tools (e.g. network monitors, malware-detection systems, routing and billing policy enforcement modules in ISPs) depend on identifying the type of traffic that passes through the network. With the widespread use of mobile devices, the vast diversity of mobile apps, and the massive adoption of encryption protocols (such as TLS), large-scale encrypted traffic classification becomes increasingly difficult. In this paper, we propose a deep learning model for mobile app identification that works even with encrypted traffic. The proposed model only needs the payload of the first few packets for classification, and, hence, it is suitable even for applications that rely on early prediction, such as routing and QoS provisioning. The deep model achieves between 84% to 98% accuracy for the identification of 80 popular apps. We also perform occlusion analysis to bring insight into what data is leaked from SSL/TLS protocol that allows accurate app identification. Moreover, our traffic analysis shows that many apps generate not only app-specific traffic, but also numerous ambiguous flows. Ambiguous flows are flows generated by common functionality modules, such as advertisement and traffic analytics. Because such flows are common among many different apps, identifying the source app that generates ambiguous flows is challenging. To address this challenge, we propose a CNN+LSTM model that uses adjacent flows to learn the order and pattern of multiple flows, to better identify the app that generates them. We show that such flow association considerably improves the accuracy, particularly for ambiguous flows. Furthermore, we show that our approach is robust to mixed traffic scenarios where some unrelated flows may appear in adjacent flows. To the best of our knowledge, this is the first work that identifies the source app for ambiguous flows.

A Look Behind the Curtain: Traffic Classification in an Increasingly Encrypted Web

“…We use a real-world mobile traffic dataset from an ISP, and demonstrate that our approach has an edge over the state-of-the-art in service classification over encrypted web traffic. Table 1 compares the performance of our model with [4] and a traditional baseline.…”

“…Using our model based on Stacked LSTM layers, we achieve an accuracy of over 95% for classification exclusively over HTTPS (i.e., HTTP/1.1 and HTTP/2 over TLS), outperforming [4] by a significant margin of nearly 50% fewer false classifications. It is also shown that our approach generally achieves higher accuracies as it is less prone to over-fitting.…”

“…Due to a lack of standard framework for traffic classification, numerous works in traffic classification (e.g., [2,7]) pick their labels somehow arbitrarily, which are often inconsistent in granularity. Furthermore, many approaches (e.g., [3,4,6,8]) use datasets with a mixed set of protocols that are often easily distinguishable using header signatures, making it unrealistic to justify the use of computationally expensive ML models. In some cases (e.g., [1]), traffic classification approaches rely on clever techniques to guide the models based on expert domain-specific knowledge that can be jeopardized by small variations in the protocol.…”

A Survey of Network Traffic Classification

“…Для коррекции весов в процессе обучения применяется алгоритм обратного распространения ошибки (backpropagation). Для работы с большим количеством параметров во внутренних слоях сети или для определения инвариантных относительно переноса признаков свою эффективность показали свёрточные нейронные сети (CNN), использующие набор небольших ядер для преобразования поступающей информации и уменьшения числа извлекаемых признаков [12,23,[27][28][29][30].…”

Automatic Mobile App Identification From Encrypted Traffic With Hybrid Neural Networks

“…The technique can be exploited by an adversary for malicious purposes like recognizing potentially sensitive or vulnerable apps. With the problem of APP-ID receiving increasingly attention, there has emerged considerable related works in recent years [2]- [18].…”