The ICSI Haystack A Platform for Hybrid Mobile Measurements in the - - PowerPoint PPT Presentation

the icsi haystack
SMART_READER_LITE
LIVE PREVIEW

The ICSI Haystack A Platform for Hybrid Mobile Measurements in the - - PowerPoint PPT Presentation

AIMS Workshop - CAIDA, February 2016 The ICSI Haystack A Platform for Hybrid Mobile Measurements in the Wild Narseo Vallina-Rodriguez In collaboration with: S. Sundaresan, C. Kreibich, M. Allman, V. Paxson (ICSI/UC Berkeley) A.


slide-1
SLIDE 1

The ICSI Haystack

A Platform for Hybrid Mobile 
 Measurements in the Wild

Narseo Vallina-Rodriguez

In collaboration with:

  • S. Sundaresan, C. Kreibich, M. Allman, V. Paxson (ICSI/UC Berkeley)

  • A. Razaghpanah, P. Gill (Stony Brook University)

AIMS Workshop - CAIDA, February 2016

slide-2
SLIDE 2

2

How much do we know about the mobile ecosystem?

slide-3
SLIDE 3

3

Privacy Performance MVNO 3G Proxies CDNs Users Apps Security WiFi Ads LTE

The mobile jigsaw

DNS QUIC IPv6 NAT CGNs TLS

ACTIVE
 MEASUREMENTS

slide-4
SLIDE 4

4

Privacy Performance MVNO 3G Proxies CDNs Users Apps Security WiFi Ads LTE

The mobile jigsaw

DNS QUIC IPv6 NAT CGNs TLS

STATIC AND 
 DYNAMIC ANALYSIS

slide-5
SLIDE 5

5

Privacy Performance MVNO 3G Proxies CDNs Users Apps Security WiFi Ads LTE

The mobile jigsaw

DNS QUIC IPv6 NAT CGNs TLS

INSTRUMENTED
 PHONES 
 (root access)

slide-6
SLIDE 6

6

Privacy Performance MVNO 3G Proxies CDNs Users Apps Security WiFi Ads LTE

The mobile jigsaw

DNS QUIC IPv6 NAT CGNs TLS

ISP
 TRACES

slide-7
SLIDE 7

7

Privacy Performance MVNO 3G Proxies CDNs Users Apps Security WiFi Ads LTE

The mobile jigsaw

DNS QUIC IPv6 NAT CGNs TLS

VPN AND 
 PROXY TRACES

slide-8
SLIDE 8

8

TRADE- OFFS!

slide-9
SLIDE 9

9

The ideal mobile measurements platform: Real-world operation Comprehensiveness Local operation Large scale

slide-10
SLIDE 10

A user-centric, and on-device measurements platform that intercepts and studies network traffic and app activity in user space

The ICSI Haystack

10

slide-11
SLIDE 11

Traffic Analyzer (off-path) Forwarder
 
 
 
 
 tun
 interface

Schematic view of Haystack

Default
 GW TLS Proxy

Anonymized
 reports (IRB)

DB @ ICSI

App traffic

Internet

Raw 
 packets Java sockets! 😢
 i.e., no-packet level traces

Max throughput: ~55 Mbps
 Extra latency < 1-4 ms 
 Battery overhead: 2-9 %

Optional TLS
 interception Contextualized 
 traffic analysis

slide-12
SLIDE 12

12

A easy-to-deploy tool for mobile users!

slide-13
SLIDE 13

The user engagement challenge

13

slide-14
SLIDE 14

14

Technical details and performance evaluation:

slide-15
SLIDE 15

Ongoing and Future Research Directions

15

slide-16
SLIDE 16

We are [mostly] in the dark about how mobile apps behave in ANY network!

“I love working for the NSA, but if I’d wanted to snoop on people’s most

intimate information, I’d have become an app developer!”

http://www.robcottingham.ca/

slide-17
SLIDE 17

Who do apps talk to, what do they talk about, and how?

17

10 20 30 40 graph.facebook.com crashlytics.com google.com googleapis.com doubleclick.net flurry.com gstatic.com googlesyndication.com amazonaws.com scorecardresearch.com googletagmanager.com amazon−adsystem.com mixpanel.com googleusercontent.com mopub.com google−analytics.com cloudfront.net twitter.com facebook.com twimg.com

% of Apps

Provides DPI and generates accurate behavioral signatures New-generation analytics and ad networks use TLS! Allows users to stay in control of their traffic

slide-18
SLIDE 18

Performance evaluation: Real-world DNS

18


 Can measure contextualized “real-world” traffic performance
 
 Enables reactive measurements [Allman+Paxson, PAM 2008]

App Median 𝞔(tApp-ttcpdump) (𝞶s) StdDev 𝞔(tApp-ttcpdump) (𝞶s) JavaApp 1,254 658 Haystack 1,211 303

slide-19
SLIDE 19
  • What are your reactions both as users and researchers?
  • How can we improve app usability and mobile transparency?
  • What are the most challenging, worrying and urging aspects 

  • f mobile systems?

19

Community feedback:

Visit: www.haystack.com