Robust Smartphone App Identification via Encrypted Network Traffic Analysis
Robust Smartphone App Identification via Encrypted Network Traffic Analysis
复制标题
DOI：
10.1109/tifs.2017.2737970
复制
发表时间：
2018-01-01
影响因子：
6.8
通讯作者：
Martinovic, Ivan
中科院分区：
文献类型：
--
作者：
Taylor, Vincent F.;Spolaor, Riccardo;Martinovic, Ivan
安装在智能手机上的应用程序可以透露有关用户的许多信息，例如他们的医疗状况，性取向或宗教信仰。此外，智能手机上存在或不存在特定应用程序可以通知意图攻击设备的对手。在本文中，我们证明了被动窃听者可以通过对智能手机应用程序发送的网络流量进行指纹识别来识别它们。尽管SSL/TLS隐藏了数据包的有效载荷，但侧信道数据（如数据包大小和方向）仍然会从加密连接中泄漏。我们使用机器学习技术从这些侧通道数据中识别智能手机应用程序。除了指纹识别和识别智能手机应用程序外，我们还研究了应用程序指纹如何随时间、跨设备和不同版本的应用程序而变化。此外，我们还介绍了一些策略，使我们的应用程序分类系统能够识别和减轻模糊流量的影响，即，应用之间的共同流量，例如广告流量。我们完全实现了一个指纹应用程序的框架，并进行了一系列实验来评估其性能。我们对Google Play商店中最受欢迎的110款应用进行了指纹识别，并在六个月后以高达96%的准确率识别出这些应用。此外，我们还发现，应用程序指纹在不同设备和应用程序版本之间存在不同程度的持久性。
The apps installed on a smartphone can reveal much information about a user, such as their medical conditions, sexual orientation, or religious beliefs. In addition, the presence or absence of particular apps on a smartphone can inform an adversary, who is intent on attacking the device. In this paper, we show that a passive eavesdropper can feasibly identify smartphone apps by fingerprinting the network traffic that they send. Although SSL/TLS hides the payload of packets, side-channel data, such as packet size and direction is still leaked from encrypted connections. We use machine learning techniques to identify smartphone apps from this side-channel data. In addition to merely fingerprinting and identifying smartphone apps, we investigate how app fingerprints change over time, across devices, and across different versions of apps. In addition, we introduce strategies that enable our app classification system to identify and mitigate the effect of ambiguous traffic, i.e., traffic in common among apps, such as advertisement traffic. We fully implemented a framework to fingerprint apps and ran a thorough set of experiments to assess its performance. We fingerprinted 110 of the most popular apps in the Google Play Store and were able to identify them six months later with up to 96% accuracy. Additionally, we show that app fingerprints persist to varying extents across devices and app versions.