【论文阅读#3】FLOWPRINT : Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic

一、论文信息

本文是发表在NDSS 2020上的一篇文章，作者在本文中提出了一种从加密的网络流量中提取移动应用程序指纹的半监督方法。该方法可以有效识别Android和iOS上的应用程序且不需要先验知识，并且工作效率可控，实验结果远超目前最先进的解决方案。

1.1、摘要原文

Mobile-application fingerprinting of network traffic is valuable for many security solutions as it provides insights into the apps active on a network. Unfortunately, existing techniques require prior knowledge of apps to be able to recognize them. However, mobile environments are constantly evolving, i.e., apps are regularly installed, updated, and uninstalled. Therefore, it is infeasible for existing fingerprinting approaches to cover all apps that may appear on a network. Moreover, most mobile traffic is encrypted, shows similarities with other apps, e.g., due to common libraries or the use of content delivery networks, and depends on user input, further complicating the fingerprinting process.

As a solution, we propose FLOWPRINT , a semi-supervised approach for fingerprinting mobile apps from (encrypted) network traffic. We automatically find temporal correlations among destination-related features of network traffic and use these correlations to generate app fingerprints. Our approach is able to fingerprint previously unseen apps, something that existing techniques fail to achieve. We evaluate our approach for both Android and iOS in the setting of app recognit