FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted - PowerPoint PPT Presentation

FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic Thijs van Ede , Riccardo Bortolameotti, Andrea Continella, Jingjing Ren, Daniel J. Dubois, Martina Lindorfer, David Choffnes, Maarten van Steen and Andreas Peter Contact: t.s.vanede@utwente.nl UNIVERSITY OF TWENTE FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic

Monitoring network traffic Internet ● Apps communicate with the internet . . . UNIVERSITY OF TWENTE FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic 2

Monitoring network traffic Internet ● Apps communicate with the internet ● Can we infer mobile app usage from network traffic? . . . UNIVERSITY OF TWENTE FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic 2

Monitoring network traffic Internet ● Apps communicate with the internet ● Can we infer mobile app usage from network traffic? ● Traffic is encrypted . . . UNIVERSITY OF TWENTE FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic 2

Monitoring network traffic Internet ● Apps communicate with the internet ● Can we infer mobile app usage from network traffic? ● Traffic is encrypted ● Apps consist of modules Authentication CDN Firebase Analytics Advertisement ... UNIVERSITY OF TWENTE FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic 2

Monitoring network traffic Internet ● Apps communicate with the internet ● Can we infer mobile app usage from network traffic? ● Traffic is encrypted ● Apps consist of modules ● Modules are shared by apps, leading to homogeneous traffic Authentication CDN Firebase Analytics Advertisement ... UNIVERSITY OF TWENTE FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic 2

Monitoring network traffic Internet ● Apps communicate with the internet ● Can we infer mobile app usage from network traffic? ● Traffic is encrypted ● Apps consist of modules ● Modules are shared by apps, leading to homogeneous traffic ● Generated traffic depends on dynamic user input Authentication CDN Firebase Analytics Advertisement ... UNIVERSITY OF TWENTE FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic 2

Monitoring network traffic Internet ● Apps communicate with the internet ● Can we infer mobile app usage from network traffic? ● Traffic is encrypted ● Apps consist of modules ● Modules are shared by apps, leading to homogeneous traffic ● Generated traffic depends on dynamic user input ● Apps on the device evolve over time Authentication CDN Firebase Analytics Advertisement ... UNIVERSITY OF TWENTE FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic 2

Monitoring network traffic Internet ● Apps communicate with the internet ● Can we infer mobile app usage from network traffic? ● Traffic is encrypted ● Apps consist of modules ● Modules are shared by apps, leading to homogeneous traffic ● Generated traffic depends on dynamic user input ● Apps on the device evolve over time ○ Removal Authentication CDN Firebase Analytics Advertisement ... UNIVERSITY OF TWENTE FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic 2

Monitoring network traffic Internet ● Apps communicate with the internet ● Can we infer mobile app usage from network traffic? ● Traffic is encrypted ● Apps consist of modules ● Modules are shared by apps, leading to homogeneous traffic ● Generated traffic depends on dynamic user input ● Apps on the device evolve over time ○ Removal Authentication CDN Firebase ○ Installation Analytics Advertisement ... UNIVERSITY OF TWENTE FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic 2

Monitoring network traffic Internet ● Apps communicate with the internet ● Can we infer mobile app usage from network traffic? ● Traffic is encrypted ● Apps consist of modules ● Modules are shared by apps, leading to homogeneous traffic ● Generated traffic depends on dynamic user input ● Apps on the device evolve over time ○ Removal Authentication CDN Firebase ○ Installation Analytics Advertisement ... ○ Update UNIVERSITY OF TWENTE FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic 2

Monitoring network traffic Internet ● Apps communicate with the internet ● Can we infer mobile app usage from network traffic? ● Traffic is encrypted Can we infer mobile app usage ● Apps consist of modules from network traffic without prior ● Modules are shared by apps, leading to homogeneous traffic knowledge of installed apps? ● Generated traffic depends on dynamic user input ● Apps on the device evolve over time ○ Removal Authentication CDN Firebase ○ Installation Analytics Advertisement ... ○ Update UNIVERSITY OF TWENTE FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic 2

Intuition Apps are composed of a unique set of modules that each communicate with a relatively invariable set of network destinations UNIVERSITY OF TWENTE FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic 3

Intuition Apps are composed of a unique set of modules that each communicate with a relatively invariable set of network destinations App X App Y Core logic CDN Authentication CDN Firebase Analytics Advertisement Advertisement UNIVERSITY OF TWENTE FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic 3

Intuition Apps are composed of a unique set of modules that each communicate with a relatively invariable set of network destinations Server X App X App Y Core logic CDN Authentication CDN Firebase Analytics Advertisement Advertisement UNIVERSITY OF TWENTE FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic 3

Intuition Apps are composed of a unique set of modules that each communicate with a relatively invariable set of network destinations CDN App X App Y Core logic CDN Authentication CDN Firebase Analytics Advertisement Advertisement UNIVERSITY OF TWENTE FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic 3

Intuition Apps are composed of a unique set of modules CDN Authentication that each communicate with a relatively invariable set of network destinations Ad network Analytics CDN Firebase Server X App X App Y Core logic CDN Authentication CDN Firebase Analytics Advertisement Advertisement UNIVERSITY OF TWENTE FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic 3

Intuition Apps are composed of a unique set of modules CDN Authentication that each communicate with a relatively invariable set of network destinations Ad network Analytics CDN Firebase Server X App X App Y Core logic CDN Authentication CDN Firebase Analytics Advertisement Advertisement UNIVERSITY OF TWENTE FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic 3

Intuition Apps are composed of a unique set of modules CDN Authentication that each communicate with a relatively invariable set of network destinations Ad network Analytics CDN Firebase Server X App X App Y Core logic CDN Authentication CDN Firebase Analytics Advertisement Advertisement UNIVERSITY OF TWENTE FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic 3

Intuition Apps are composed of a unique set of modules CDN Authentication that each communicate with a relatively invariable set of network destinations Ad How do we extract these network Analytics patterns without prior CDN Firebase knowledge of the apps? Server X App X App Y Core logic CDN Authentication CDN Firebase Analytics Advertisement Advertisement UNIVERSITY OF TWENTE FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic 3

FlowPrint - Overview UNIVERSITY OF TWENTE FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic 4

FlowPrint - Feature extraction For each flow in the network, we extract ● Originating device ● Destination (IP, port)-tuple ● TLS certificate ● Timestamps UNIVERSITY OF TWENTE FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic 5

FlowPrint - Clustering In 5 minute batches, we cluster flows by network destination: ● Destination (IP, port)-tuple or ● TLS certificate CDN Authentication Ad network CDN Firebase Analytics UNIVERSITY OF TWENTE FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic 6

FlowPrint - Clustering In 5 minute batches, we cluster flows by network destination: ● Destination (IP, port)-tuple or ● TLS certificate UNIVERSITY OF TWENTE FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic 6

FlowPrint - Clustering In 5 minute batches, we cluster flows by network destination: ● Destination (IP, port)-tuple or ● TLS certificate ● Some of these clusters are shared UNIVERSITY OF TWENTE FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic 6