Analyzing Android Encrypted Network Traffic to Identify User Actions

Abstract

Mobile devices can be maliciously exploited to violate the privacy of people. In most attack scenarios, the adversary takes the local or remote control of the mobile device, by leveraging a vulnerability of the system, hence sending back the collected information to some remote web service. In this paper, we consider a different adversary, who does not interact actively with the mobile device, but he is able to eavesdrop the network traffic of the device from the network side (e.g., controlling a Wi-Fi access point). The fact that the network traffic is often encrypted makes the attack even more challenging. In this paper, we investigate to what extent such an external attacker can identify the specific actions that a user is performing on her mobile apps. We design a system that achieves this goal using advanced machine learning techniques. We built a complete implementation of this system, and we also run a thorough set of experiments, which show that our attack can achieve accuracy and precision higher than 95%, for most of the considered actions. We compared our solution with the three state-of-the-art algorithms, and confirming that our system outperforms all these direct competitors

Applying Big Data, Machine Learning, and SDN/NFV for 5G Early-Stage Traffic Classification and Network QoS Control

“…Virtual SON (VSON), which integrates lately developed technologies such as software-defined wireless networking (SDWN), NFV, big data, ML, has been recently introduced as a prime proposal for future SON [17]. In this subsection, we propose and analyze an Open-SON for 5G in which we can apply data analytics and ML algorithms to develop variety SON applications.…”

Profiling Users by Modeling Web Transactions

“…intrusion detection [12], the identification of Android applications usage [2], IoT devices [7] or web crawlers [4]. Most proposals focus though on modeling communications made by a single host [5], [6], [13] i.e.…”

“…Modeling network communication patterns has several applications including intrusion detection [12], bot detection [4] and identification of running applications on a device [2]. While network traffic monitoring has also been used to profile host communications [3], [5], [13], little attention has been given to profiling a specific user based on the network traffic she generates.…”

An adaptive smartphone anomaly detection model based on data mining

“…Therefore, we can identify malware by analyzing the critical behavior of application software in network traffic. A number of traffic features have been identified for malicious apps detection [3][4][5][6][7][8]. However, the prior arts have encountered some challenges, such as the lack of sufficient labeled traffic data, and most of the mobile devices intrusion detection systems use a host-based intrusion detection model [6][7][8], which means that the intrusion detection system is installed as a client on the smartphone.…”