Multi-classification approaches for classifying mobile app traffic

Aceto, Giuseppe; Ciuonzo, Domenico; Montieri, Antonio; Pescapè, Antonio

doi:10.1016/j.jnca.2017.11.007

Cited by 153 publications

(92 citation statements)

References 40 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Without this practice, their model's robustness is frustrated in terms of devices and app versions [4]. Recently, Aceto et al [6] proposed a multiclassification approach of intelligently combining outputs from state-of-the-art classifiers to improve the performance of APP-ID. e performance can be improved according to all considered metrics up to +9.5% recall score with respect to the best base classifier.…”

Section: Traffic Classification For App-idmentioning

confidence: 99%

“…Most previously proposed APP-ID solutions report decent performance with results based on private datasets, usually labeled by approaches of unknown reliability. In order to obtain the ground truth, the most common way is running apps one by one separately and manually label the trace [6]. It is, however, not viable due to the background traffic generated by system or sleeping apps.…”

Section: Mobile Traffic Collection and Dataset Constructionmentioning

confidence: 99%

“…is trend, however, makes DPI based on signatures no longer viable and ML techniques gain more and more attention from scientific research to commercial applications. Multiple conventional ML classifiers have proven successful in mobile as well as traditional traffic classification [5][6][7][8]. Nevertheless, they are subject to the manual process of feature engineering, which can be timeconsuming and prone to obsolescence.…”

Section: Introductionmentioning

confidence: 99%

“…Last but not least, we are confronted by the usual obstacle to progress on APP-ID: lack of a variety of real-world mobile traffic to serve as train-test data as well as ground truth (i.e., annotated flow objects used as reference) for validation. Most of the previous works seem to neglect this quandary, which is quite important for training and testing ML or DL models [4][5][6]. Usually, they base their results on ground truth built from private datasets and labeled by means of unknown reliability.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Real Network Traffic Collection and Deep Learning for Mobile App Identification

Wang

Chen

2020

Wireless Communications and Mobile Computing

View full text Add to dashboard Cite

The proliferation of mobile devices over recent years has led to a dramatic increase in mobile traffic. Demand for enabling accurate mobile app identification is coming as it is an essential step to improve a multitude of network services: accounting, security monitoring, traffic forecasting, and quality-of-service. However, traditional traffic classification techniques do not work well for mobile traffic. Besides, multiple machine learning solutions developed in this field are severely restricted by their handcrafted features as well as unreliable datasets. In this paper, we propose a framework for real network traffic collection and labeling in a scalable way. A dedicated Android traffic capture tool is developed to build datasets with perfect ground truth. Using our established dataset, we make an empirical exploration on deep learning methods for the task of mobile app identification, which can automate the feature engineering process in an end-to-end fashion. We introduce three of the most representative deep learning models and design and evaluate our dedicated classifiers, namely, a SDAE, a 1D CNN, and a bidirectional LSTM network, respectively. In comparison with two other baseline solutions, our CNN and RNN models with raw traffic inputs are capable of achieving state-of-the-art results regardless of TLS encryption. Specifically, the 1D CNN classifier obtains the best performance with an accuracy of 91.8% and macroaverage F-measure of 90.1%. To further understand the trained model, sample-specific interpretations are performed, showing how it can automatically learn important and advanced features from the uppermost bytes of an app’s raw flows.

show abstract

Section: Traffic Classification For App-idmentioning

confidence: 99%

Section: Mobile Traffic Collection and Dataset Constructionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Real Network Traffic Collection and Deep Learning for Mobile App Identification

Wang

Chen

2020

Wireless Communications and Mobile Computing

View full text Add to dashboard Cite

show abstract

“…Indeed, TC-consisting in associating traffic aggregates to specific applications or groups of applications (viz. labeling them)-is of utmost importance in Internet traffic engineering, along with related methodologies & tools, as they jointly support activities such as network monitoring, security assessment, application identification, anomaly detection, accounting, advertising, and service differentiation [2,3]. For these reasons, TC has gained importance in recent years due to growing incentives to disguise certain applications [4], comprising those generating anonymous traffic [5].…”

Section: Introductionmentioning

confidence: 99%

A Dive into the Dark Web: Hierarchical Traffic Classification of Anonymity Tools

Montieri

Ciuonzo

Bovenzi

et al. 2020

IEEE Trans. Netw. Sci. Eng.

Self Cite

View full text Add to dashboard Cite

Privacy-preserving protocols and tools are increasingly adopted by Internet users nowadays. These mechanisms are challenged by the process of Traffic Classification (TC) which, other than being an important workhorse for several network management tasks, becomes a key factor in the assessment of their privacy level, both from offensive (malign) and defensive (benign) standpoints. In this paper we propose TC of anonymity tools (and deeper, of their running services and applications) via a truly hierarchical approach. Capitalizing a public dataset released in 2017 containing anonymity traffic, we provide an in-depth analysis of TC and we compare the proposed hierarchical approach with a flat counterpart. The proposed framework is investigated in both the usual TC setup and its "early" variant (i.e. only the first segments of traffic aggregate are used to take a decision). Results highlight a general improvement over the flat approach in terms of all the classification metrics. Further performance gains are also accomplished by tuning the thresholds ensuring progressive censoring. Finally, fine-grain performance investigation allows to (a) demonstrate lower severity of errors incurred by the hierarchical approach (as opposed to the flat case) and (b) highlight poorly-classifiable services/applications of each anonymity tool, gathering useful feedback on their privacy-level.

show abstract