Summary
Apps on your phone send data over the internet, and even if this data is encrypted, clues about which apps are running can still be detected by looking at hidden traffic patterns. The authors found that current ways to detect apps from this traffic aren't reliable when network conditions change or when several apps run together. They created MAppPrint, a new method that looks at the relationships between different parts of app traffic, compresses this information for faster detection, and can separate mixed traffic from multiple apps. Their approach is more accurate and faster than previous methods, working well even in changing network situations.
What this means in practice
- •For network security teams: Detect and track running mobile apps accurately and quickly through encrypted traffic even in complex or dynamic network environments.
- •For mobile network operators: Enable detailed monitoring of mobile app usage on their networks for better traffic management and optimization during multi-app usage scenarios.
Authors
Tao Duan, Junzhou Zhao, Jianglong Li, RongHua Li, Youqian Zhang, Nuo Xu, Pinghui Wang, Haibo Hu
Abstract
Mobile apps have become ubiquitous in daily life. Despite communication encryption, app fingerprinting (AF) attacks can still enable adversaries to infer the apps in use by analyzing patterns of encrypted network traffic. However, existing AF attacks suffer from three critical limitations that hinder their practical effectiveness: (i) the inability to capture app-specific traffic dependencies, rendering traffic fingerprints fragile under dynamic networking conditions; (ii) the neglect of latency and throughput considerations, resulting in inefficient real-time user tracking; and (iii) the incapacity to handle mixed traffic generated by multi-app concurrency. In this paper, we propose MAppPrint, a robust and real-time app fingerprinting framework. MAppPrint introduces a behavior-level traffic fingerprint, i.e., Traffic Behavior Correlation Graph (TBCG), which models app traffic by capturing unit traffic behaviors and their correlations, thereby providing reliable app fingerprints. To enable real-time fingerprinting, MAppPrint incorporates a fingerprint compression algorithm that transforms each TBCG into a compact graph by selectively aggregating redundant information. Furthermore, MAppPrint employs an unsupervised decomposition strategy to disentangle mixed traffic generated by multi-app concurrency, enabling unified identification of both single-app and multi-app traffic. Extensive experimental results demonstrate that MAppPrint achieves 4.9~13.9% improvement in AF precision and 3~6 times improvement in timeliness over state-of-the-art methods. Meanwhile, MAppPrint is robust in dynamic networking conditions, while achieving a throughput of 10.5 GB/s and a prediction latency of 0.68 seconds.