flowprint semi supervised mobile app fingerprinting on
play

FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted - PowerPoint PPT Presentation

FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic Thijs van Ede , Riccardo Bortolameotti, Andrea Continella, Jingjing Ren, Daniel J. Dubois, Martina Lindorfer, David Choffnes, Maarten van Steen and Andreas Peter


  1. FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic Thijs van Ede , Riccardo Bortolameotti, Andrea Continella, Jingjing Ren, Daniel J. Dubois, Martina Lindorfer, David Choffnes, Maarten van Steen and Andreas Peter Contact: t.s.vanede@utwente.nl UNIVERSITY OF TWENTE FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic

  2. Monitoring network traffic Internet ● Apps communicate with the internet . . . UNIVERSITY OF TWENTE FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic 2

  3. Monitoring network traffic Internet ● Apps communicate with the internet ● Can we infer mobile app usage from network traffic? . . . UNIVERSITY OF TWENTE FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic 2

  4. Monitoring network traffic Internet ● Apps communicate with the internet ● Can we infer mobile app usage from network traffic? ● Traffic is encrypted . . . UNIVERSITY OF TWENTE FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic 2

  5. Monitoring network traffic Internet ● Apps communicate with the internet ● Can we infer mobile app usage from network traffic? ● Traffic is encrypted ● Apps consist of modules Authentication CDN Firebase Analytics Advertisement ... UNIVERSITY OF TWENTE FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic 2

  6. Monitoring network traffic Internet ● Apps communicate with the internet ● Can we infer mobile app usage from network traffic? ● Traffic is encrypted ● Apps consist of modules ● Modules are shared by apps, leading to homogeneous traffic Authentication CDN Firebase Analytics Advertisement ... UNIVERSITY OF TWENTE FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic 2

  7. Monitoring network traffic Internet ● Apps communicate with the internet ● Can we infer mobile app usage from network traffic? ● Traffic is encrypted ● Apps consist of modules ● Modules are shared by apps, leading to homogeneous traffic ● Generated traffic depends on dynamic user input Authentication CDN Firebase Analytics Advertisement ... UNIVERSITY OF TWENTE FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic 2

  8. Monitoring network traffic Internet ● Apps communicate with the internet ● Can we infer mobile app usage from network traffic? ● Traffic is encrypted ● Apps consist of modules ● Modules are shared by apps, leading to homogeneous traffic ● Generated traffic depends on dynamic user input ● Apps on the device evolve over time Authentication CDN Firebase Analytics Advertisement ... UNIVERSITY OF TWENTE FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic 2

  9. Monitoring network traffic Internet ● Apps communicate with the internet ● Can we infer mobile app usage from network traffic? ● Traffic is encrypted ● Apps consist of modules ● Modules are shared by apps, leading to homogeneous traffic ● Generated traffic depends on dynamic user input ● Apps on the device evolve over time ○ Removal Authentication CDN Firebase Analytics Advertisement ... UNIVERSITY OF TWENTE FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic 2

  10. Monitoring network traffic Internet ● Apps communicate with the internet ● Can we infer mobile app usage from network traffic? ● Traffic is encrypted ● Apps consist of modules ● Modules are shared by apps, leading to homogeneous traffic ● Generated traffic depends on dynamic user input ● Apps on the device evolve over time ○ Removal Authentication CDN Firebase ○ Installation Analytics Advertisement ... UNIVERSITY OF TWENTE FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic 2

  11. Monitoring network traffic Internet ● Apps communicate with the internet ● Can we infer mobile app usage from network traffic? ● Traffic is encrypted ● Apps consist of modules ● Modules are shared by apps, leading to homogeneous traffic ● Generated traffic depends on dynamic user input ● Apps on the device evolve over time ○ Removal Authentication CDN Firebase ○ Installation Analytics Advertisement ... ○ Update UNIVERSITY OF TWENTE FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic 2

  12. Monitoring network traffic Internet ● Apps communicate with the internet ● Can we infer mobile app usage from network traffic? ● Traffic is encrypted Can we infer mobile app usage ● Apps consist of modules from network traffic without prior ● Modules are shared by apps, leading to homogeneous traffic knowledge of installed apps? ● Generated traffic depends on dynamic user input ● Apps on the device evolve over time ○ Removal Authentication CDN Firebase ○ Installation Analytics Advertisement ... ○ Update UNIVERSITY OF TWENTE FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic 2

  13. Intuition Apps are composed of a unique set of modules that each communicate with a relatively invariable set of network destinations UNIVERSITY OF TWENTE FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic 3

  14. Intuition Apps are composed of a unique set of modules that each communicate with a relatively invariable set of network destinations App X App Y Core logic CDN Authentication CDN Firebase Analytics Advertisement Advertisement UNIVERSITY OF TWENTE FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic 3

  15. Intuition Apps are composed of a unique set of modules that each communicate with a relatively invariable set of network destinations Server X App X App Y Core logic CDN Authentication CDN Firebase Analytics Advertisement Advertisement UNIVERSITY OF TWENTE FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic 3

  16. Intuition Apps are composed of a unique set of modules that each communicate with a relatively invariable set of network destinations CDN App X App Y Core logic CDN Authentication CDN Firebase Analytics Advertisement Advertisement UNIVERSITY OF TWENTE FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic 3

  17. Intuition Apps are composed of a unique set of modules CDN Authentication that each communicate with a relatively invariable set of network destinations Ad network Analytics CDN Firebase Server X App X App Y Core logic CDN Authentication CDN Firebase Analytics Advertisement Advertisement UNIVERSITY OF TWENTE FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic 3

  18. Intuition Apps are composed of a unique set of modules CDN Authentication that each communicate with a relatively invariable set of network destinations Ad network Analytics CDN Firebase Server X App X App Y Core logic CDN Authentication CDN Firebase Analytics Advertisement Advertisement UNIVERSITY OF TWENTE FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic 3

  19. Intuition Apps are composed of a unique set of modules CDN Authentication that each communicate with a relatively invariable set of network destinations Ad network Analytics CDN Firebase Server X App X App Y Core logic CDN Authentication CDN Firebase Analytics Advertisement Advertisement UNIVERSITY OF TWENTE FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic 3

  20. Intuition Apps are composed of a unique set of modules CDN Authentication that each communicate with a relatively invariable set of network destinations Ad How do we extract these network Analytics patterns without prior CDN Firebase knowledge of the apps? Server X App X App Y Core logic CDN Authentication CDN Firebase Analytics Advertisement Advertisement UNIVERSITY OF TWENTE FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic 3

  21. FlowPrint - Overview UNIVERSITY OF TWENTE FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic 4

  22. FlowPrint - Feature extraction For each flow in the network, we extract ● Originating device ● Destination (IP, port)-tuple ● TLS certificate ● Timestamps UNIVERSITY OF TWENTE FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic 5

  23. FlowPrint - Clustering In 5 minute batches, we cluster flows by network destination: ● Destination (IP, port)-tuple or ● TLS certificate CDN Authentication Ad network CDN Firebase Analytics UNIVERSITY OF TWENTE FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic 6

  24. FlowPrint - Clustering In 5 minute batches, we cluster flows by network destination: ● Destination (IP, port)-tuple or ● TLS certificate UNIVERSITY OF TWENTE FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic 6

  25. FlowPrint - Clustering In 5 minute batches, we cluster flows by network destination: ● Destination (IP, port)-tuple or ● TLS certificate ● Some of these clusters are shared UNIVERSITY OF TWENTE FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic 6

Recommend


More recommend