NetworkProfiler: Towards automatic fingerprinting of Android apps

Abstract

Network operators need to have a clear visibility into the applications running in their network. This is critical for both security and network management. Recent years have seen an exponential growth in the number of smart phone apps which has complicated this task. Traditional methods of traffic classification are no longer sufficient as the majority of this smart phone app traffic is carried over HTTP/HTTPS. Keeping up with the new applications that come up everyday is very challenging and time-consuming. We present a novel technique for automatically generating network profiles for identifying Android apps in the HTTP traffic. A network profile consists of fingerprints, i.e., unique characteristics of network behavior, that can be used to identify an app. To profile an Android app, we run the app automatically in an emulator and collect the network traces. We have developed a novel UI fuzzing technique for running the app such that different execution paths are exercised, which is necessary to build a comprehensive network profile. We have also developed a light-weight technique, for extracting fingerprints, that is based on identifying invariants in the generated traces. We used our technique to generate network profiles for thousands of apps. Using our network profiles we were able to detect the presence of these apps in real-world network traffic logs from a cellular provider.

Understanding Mobile App Usage Patterns Using In-App Advertisements

“…We have developed a system for analyzing Android apps that installs and runs each Android app in a separate emulator running in a virtual machine [13]. Here we describe the parts of the system relevant for collecting ad flows.…”

“…A limitation of this technique is that some of the ad networks require developer identifiers which can be shared by different apps from the same developer. We have observed that queries from many apps have certain unique patterns (such as certain key-value parameters in the URL query) that can be used to identify them [13]. In the future we plan to analyze patterns in the URL queries in ad flows to form fingerprints that can be used to correctly attribute the flow to the originating app.…”

Monkey Gamer: Automatic Profiling of Android Games

“…Previous approaches to automatic profiling Android applications have been targeting just a specific game [8], or just a specific aspect of games, like the game energy states [7], game network connections [11], game security [9] or privacy, i.e., access to user sensitive data by games [10]. A number of works test generic Android applications, without specifically targeting games, but they either relay on completely random input generation [14], application-specific input generation [15], a properly tuned mix of random input and input paths generated from a given application-specific seed [11], or a prior knowledge of all the interactive elements present in each game state [12].…”

“…A number of works test generic Android applications, without specifically targeting games, but they either relay on completely random input generation [14], application-specific input generation [15], a properly tuned mix of random input and input paths generated from a given application-specific seed [11], or a prior knowledge of all the interactive elements present in each game state [12]. Finally, there are approaches to test generic Android applications from a holistic point of view, but using human players instead of automated input [13].…”

MAPPER: A Mobile Application Personal Policy Enforcement Router for Enterprise Networks

“…Similar migration is handled across multiple devices used by the same individual. A stand-alone module, interacting with the MAPPER system through a specific net app, handles mobile application identification and categorization [3]- [5]. Furthermore, by executing a man-in-the-middle proxy module [6], MAPPER also provides visibility into encrypted application traffic.…”