I know what you did on your smartphone: Inferring app usage over encrypted data traffic

Qinglong Wang, Amir Yahyavi, Bettina Kemme, Wenbo He

Research output: Chapter in Book/Report/Conference proceedingConference contribution

46 Scopus citations

Abstract

Smartphones and tablets are now ubiquitous in many people's lives and are used throughout the day in many public places. They are often connected to a wireless local area network (IEEE 802.11 WLANs) and rely on encryption protocols to maintain their security and privacy. In this paper, we show that even in presence of encryption, an attacker without access to encryption keys is able to determine the users' behavior, in particular, their app usage. We perform this attack using packet-level traffic analysis in which we use side-channel information leaks to identify specific patterns in packets regardless of whether they are encrypted or not. We show that just by collecting and analyzing small amounts of wireless traffic, one can determine what apps each individual smartphone user in the vicinity is using. Furthermore, and more worrying, we show that by using these apps the privacy of the user is more at risk compared to using online services through browsers on mobile devices. This is due to the fact that apps generate more identifiable traffic patterns. Using random forests to classify the apps we show that we are able to identify individual apps, even in presence of noise, with great accuracy. Given that most online services now provide native apps that may be identified by this method, these attacks represent a serious threat to users' privacy.

Original languageEnglish (US)
Title of host publication2015 IEEE Conference on Communications and NetworkSecurity, CNS 2015
PublisherInstitute of Electrical and Electronics Engineers Inc.
Pages433-441
Number of pages9
ISBN (Electronic)9781467378765
DOIs
StatePublished - Dec 3 2015
Event3rd IEEE International Conference on Communications and Network Security, CNS 2015 - Florence, Italy
Duration: Sep 28 2015Sep 30 2015

Publication series

Name2015 IEEE Conference on Communications and NetworkSecurity, CNS 2015

Other

Other3rd IEEE International Conference on Communications and Network Security, CNS 2015
Country/TerritoryItaly
CityFlorence
Period9/28/159/30/15

All Science Journal Classification (ASJC) codes

  • Computer Networks and Communications

Fingerprint

Dive into the research topics of 'I know what you did on your smartphone: Inferring app usage over encrypted data traffic'. Together they form a unique fingerprint.

Cite this