Automatically identifying apps in mobile traffic

Abstract

Summary With the rapid development of smartphones in recent years, we have witnessed an exponential growth of the number of mobile apps. Considering the security and management issues, network operators need to have a clear visibility into the apps running in the network. To this end, this paper presents a novel approach to generating the fingerprints for mobile apps from network traffic. The fingerprints that characterize the unique behaviors of specific mobile apps can be used to identify mobile apps from the real network traffic. In order to handle the large volume of traffic efficiently, we use non‐negative matrix factorization (NMF) to perform traffic analysis to cluster similar network traffic into groups. Then, access patterns of individual apps that are extracted from each group can be used as fingerprints distinguishing apps from others uniquely. The experimental evaluations show that the proposed approach can identify the mobile apps from random and mixed network traffic with high precision. Copyright © 2015 John Wiley & Sons, Ltd.

Mobile app identification for encrypted network flows by traffic correlation

“…As shown in Figure 12, the accuracy of the similar traffic retrieval method for app identification is significantly lower than that of DNS clustering. Inspired by recent works, 15,17,18 we can further use the identification features contained in the HTTP header to improve the accuracy. To be specific, if the correlated flow (TCP or UDP flow preceded by DNS lookups) is the HTTP protocol, we identify its app by both the key–value matching 15 and hostname matching techniques.…”

“…After that, a search engine was employed as a kernel function to generate a score distribution vis-a`vis the index documents and finally determine a match. Sun et al 18 extracted identification features from the HTTP method, request URI, and host field and used nonnegative matrix factorization to cluster similar features into groups.…”

“…For the same reason, traditional approaches 13,14 for identifying desktop applications are too coarse grained for mobile apps. To address this problem, several recent studies [15][16][17][18][19] have been conducted and various types of identification techniques have been proposed. However, most of them have been focused on plaintext flows (e.g.…”

AppFA: A Novel Approach to Detect Malicious Android Applications on the Network

“…Recently, there are an increasing number of research works that analyze network traffic to identify app, such as [27][28][29][30][31][32]. However, most of them were focused on plaintext flows (e.g., HTTP) and tried to collect identification features from HTTP headers.…”