PaperlayerView exact revision on arXiv

Source-linked AI summary

MAppPrint: Robust and Real-time Mobile App Fingerprinting via Traffic Behavior Correlation Graphs

Tao Duan, Junzhou Zhao, Jianglong Li, RongHua Li, Youqian Zhang, Nuo Xu, Pinghui Wang, Haibo Hu

arXiv:2610.22148v1cs.CRcs.NI

TL;DR

Existing app-fingerprinting methods have difficulty capturing app-specific traffic dependencies, meeting real-time demands, and handling traffic mixed from concurrent apps. MAppPrint models behavior-level correlations in Traffic Behavior Correlation Graphs, compresses those graphs, and decomposes mixed traffic. It reports improved precision and timeliness over state-of-the-art methods, alongside dynamic-network robustness and online throughput and latency results.

  • Problem

    Existing app-fingerprinting methods have limitations in modeling app-specific traffic dependencies, real-time latency and throughput, and mixed traffic from concurrent apps.

    Source: §I · p. 2

  • Method

    MAppPrint models unit traffic behaviors and their temporal correlations as TBCGs, compresses redundant graph information, and uses unsupervised decomposition for multi-app traffic.

    Source: §I · p. 2, D. TBCG Compression · p. 5, §IV · p. 6

  • Results

    4.9–13.9% improvement in AF precision and 3–6 times improvement in timeliness over state-of-the-art methods, with 10.5 GB/s average throughput and 0.68 seconds prediction latency online.

    Source: §I · p. 2

  • Takeaways & Limitations

    MAppPrint is reported to fingerprint traffic robustly in dynamic networking while supporting both single- and multi-app traces.

    Source: §VIII · p. 14

    MAppPrint is designed for deployment before NAT, where flows from different devices can be separated in advance.

    Source: §VI · p. 13

Abstract

from arXiv · show

Mobile apps have become ubiquitous in daily life. Despite communication encryption, app fingerprinting (AF) attacks can still enable adversaries to infer the apps in use by analyzing patterns of encrypted network traffic. However, existing AF attacks suffer from three critical limitations that hinder their practical effectiveness: (i) the inability to capture app-specific traffic dependencies, rendering traffic fingerprints fragile under dynamic networking conditions; (ii) the neglect of latency and throughput considerations, resulting in inefficient real-time user tracking; and (iii) the incapacity to handle mixed traffic generated by multi-app concurrency. In this paper, we propose MAppPrint, a robust and real-time app fingerprinting framework. MAppPrint introduces a behavior-level traffic fingerprint, i.e., Traffic Behavior Correlation Graph (TBCG), which models app traffic by capturing unit traffic behaviors and their correlations, thereby providing reliable app fingerprints. To enable real-time fingerprinting, MAppPrint incorporates a fingerprint compression algorithm that transforms each TBCG into a compact graph by selectively aggregating redundant information. Furthermore, MAppPrint employs an unsupervised decomposition strategy to disentangle mixed traffic generated by multi-app concurrency, enabling unified identification of both single-app and multi-app traffic. Extensive experimental results demonstrate that MAppPrint achieves 4.9~13.9% improvement in AF precision and 3~6 times improvement in timeliness over state-of-the-art methods. Meanwhile, MAppPrint is robust in dynamic networking conditions, while achieving a throughput of 10.5 GB/s and a prediction latency of 0.68 seconds.

I. INTRODUCTION

MAppPrint targets the robustness, timeliness, and mixed-traffic gaps in app fingerprinting with behavior-level fingerprints, compression, and unified identification. Its threat model includes dynamic networks and concurrent apps, while excluding payload and destination metadata.

I. INTRODUCTION

  • Existing multi-flow methods use coarse flow-concurrency patterns, leaving fingerprints vulnerable to network changes and ambiguous traffic, while long observation windows and high traffic volumes impede real-time use.They also assume one app is active at a time, so mixed traces disrupt individual app fingerprints.Source: §I · pp. 1–2
  • MAppPrint models fine-grained unit traffic behaviors and their temporal dependencies as TBCGs, aiming to produce more reliable fingerprints under dynamic and ambiguous traffic.The paper relates behavior correlations to app operational logic and module dependencies.Source: §I · p. 2
  • Selective aggregation of similar, redundant TBCG nodes and edges compresses fingerprints to improve throughput while preserving critical fingerprint information.The paper motivates compression by repeated invocations of modules that generate similar traffic behaviors.Source: §I · p. 2
  • An unsupervised strategy uses inter-flow similarities to split multi-app TBCGs into single-app TBCGs, followed by lightweight prediction of single- and multi-app labels without prior knowledge of app count.The number of concurrent apps and their traffic boundaries are unknown.Source: §I · p. 2
  • 4.9–13.9% improvement in AF precision and 3–6 times improvement in timeliness over state-of-the-art methods; online deployment averages 10.5 GB/s throughput and 0.68 seconds prediction latency.Experiments span 12 datasets; the paper also reports robustness in dynamic network environments.Source: §I · p. 2

A. Threat Model and Design Goals

  • The threat model covers encrypted traffic observed at the network edge, dynamic network conditions, real-time high-volume tracking, and concurrent apps, but assumes no payload or destination-related metadata access.The adversary trains offline on target-app traffic and deploys the trained model on a target network.Source: A. Threat Model and Design Goals · pp. 2–3

B. Overview of MAppPrint

MAppPrint constructs app fingerprints from unit traffic behaviors and their correlations, then compresses the resulting graphs and identifies apps in single- or multi-app traces. Unit behaviors are compact packet sequences intended to capture stable, semantically meaningful activity.

B. Overview of MAppPrint

  • MAppPrint processes traffic through TBCG construction, compression, and app identification; it directly identifies single-app graphs and decomposes multi-app graphs into single-app graphs before identification.The overview describes behavior-level dependencies as a basis for stable fingerprints in dynamic and ambiguous traffic.Source: B. Overview of MAppPrint · p. 3

III. TRAFFIC BEHAVIOR CORRELATION GRAPH

  • TBCGs use unit traffic behaviors as nodes and correlations among them as edges, with redundant nodes and edges merged to reduce graph size.The overview describes the compressed graph as retaining key structures for online throughput.Source: §III · p. 3, B. Overview of MAppPrint · p. 3

A. Unit Traffic Behavior Extraction

  • A unit traffic behavior is a semantically complete sequence of a few consecutive packets with small inter-arrival times, used as the basic analysis unit instead of packets or flows.Such packet sequences are described as relatively stable and interpretable in relation to app activity.Source: A. Unit Traffic Behavior Extraction · p. 3

2. TBCG Compression

  • Each unit behavior is represented by a 12-dimensional feature vector spanning transmission, length, and time features, emphasizing local patterns while neglecting specific packet details.The paper presents this feature design as a way to mitigate dynamic-network effects on fingerprint stability.Source: §2 · p. 4

B. Correlations of Unit Traffic Behaviors

MAppPrint represents relations among unit traffic behaviors with sequential, triggering, and concurrent correlations. These relations describe within-flow interaction, cross-flow triggering, and overlapping cross-flow activity.

B. Correlations of Unit Traffic Behaviors

  • Sequential correlation links temporally consecutive behaviors in the same flow, representing request-response communication and client-server interaction patterns.The relation requires consecutive behaviors with inter-arrival time below a threshold.Source: B. Correlations of Unit Traffic… · pp. 4–5
  • Triggering correlation links temporally consecutive behaviors in different, non-overlapping flows, representing causal relationships and functional dependencies between app modules.The paper illustrates it with a payment request triggering authentication before payment.Source: B. Correlations of Unit Traffic… · pp. 4–5
  • Concurrent correlation links temporally consecutive behaviors in different flows whose durations overlap, representing inter-flow collaboration during simultaneous resource requests.The paper gives a UI refresh with text, image, and video as an example.Source: B. Correlations of Unit Traffic… · pp. 4–5

C. TBCG Construction

A TBCG represents traffic behaviors as nodes and their correlations as directed edges. MAppPrint compresses these graphs by merging similar behaviors, then uses behavior patterns to support single- and multi-app identification.

C. TBCG Construction

  • A TBCG is a directed acyclic graph whose nodes represent unit traffic behaviors and whose edges represent correlations among them.Each node is represented by a 12-dimensional vector; concurrent correlations are represented by edges in both directions.Source: C. TBCG Construction · p. 5

D. TBCG Compression

  • On 3,000 ten-second Facebook traces, TBCGs averaged 164 nodes and 325 edges, with some graphs containing thousands, motivating compression for efficient fingerprinting.Figure 3 reports statistics on TBCG sizes.Source: D. TBCG Compression · p. 5, Figure 3 · p. 5
  • MAppPrint compares each node with K representative anchors, reducing similarity-computation complexity from O(|V|^2α) to O(K|V|α), with K/|V| in [0.1, 0.2] balancing compression and accuracy.The passage describes pairwise similarity as the costly alternative and reports the empirical anchor ratio.Source: D. TBCG Compression · p. 5
  • Short behaviors contain no more than three packets; anchors use frequent full sequences for short behaviors and frequent packet-length subsequences for long behaviors.The anchor set is selected offline; nodes sharing an anchor are merged into pseudo-nodes that inherit constituent edges, with duplicate edges removed.Source: D. TBCG Compression · pp. 5–6

A. Key Idea

  • Multi-app traces are mixtures that make identification more difficult, and collecting labeled examples for every app combination is costly.The proposed strategy distinguishes single- from multi-app traffic using predicted-label distributions, then separates multi-app traffic using similarities between TBCG subgraphs.Source: §IV · p. 6, A. Key Idea · p. 6

B. App Identification from Single-App Traffic

For single-app traffic, MAppPrint uses one graph neural network one-vs-rest classifier per app. Their normalized outputs form a distribution of app confidence scores.

C. Differentiating Single-/Multi-App Traffic

MAppPrint distinguishes single- from multi-app traffic by comparing a classifier confidence distribution with an ideal one-point distribution. For mixed traffic, it decomposes the graph into app-specific subgraphs and applies the single-app classifier.

C. Differentiating Single-/Multi-App Traffic

  • The similarity score compares predicted app probabilities with a one-point distribution whose peak is at the maximum-probability app.The score is based on chi-squared distance; a threshold derived from labeled single-app traces determines whether processing ends with a single-app prediction or continues.Source: C. Differentiating Single-/Multi-App… · p. 7

D. Reducing Multi-App Traffic Identification to Single-App Traffic Identification

  • For multi-app traffic, MAppPrint removes triggering and concurrent correlations, clusters subgraphs by their 10-dimensional features, and reconstructs one TBCG per cluster.The resulting single-app TBCGs are classified individually using the single-app classifier.Source: D. Reducing Multi-App Traffic… · p. 7

A. Experimental Setup

  • The evaluation compares precision and F1 score against four single-flow and four multi-flow fingerprinting baselines.The experiments include public datasets and six newly collected datasets for dynamic-networking and multi-app scenarios.Source: A. Experimental Setup · p. 8
  • The MAMF dataset contains traces from two to five concurrent apps because more extreme concurrency leaves most background apps idle and produces sparse traffic.Foreground apps are opened in split-screen mode, while background apps are kept active through online modes such as media playback or file transfer.Source: A. Experimental Setup · p. 8
  • The dynamic-networking datasets cover app updates over 120 days, collection in three cities, different bandwidths and network types, and simulated failures with rates from 0 to 30%.The model is trained in an initial environment and evaluated in other environments with its parameters frozen.Source: §V · p. 7, A. Experimental Setup · p. 8

B. Single-App Fingerprinting Evaluation

MAppPrint outperforms the strongest baselines in both single-app and multi-app fingerprinting, with gains also reported on ambiguous traces. Its multi-app performance is comparatively stable as concurrency increases, while foreground apps are generally identified more accurately than background apps.

B. Single-App Fingerprinting Evaluation

C. Multi-App Fingerprinting Evaluation

D. Robustness Evaluation

MAppPrint maintains fingerprint precision across network failures and changing environments. Its TBCG compression supports high throughput with low prediction latency while largely preserving precision.

D. Robustness Evaluation

  • After 120 days, precision remained above 65.0% on a 94-app dataset where more than 80.0% of apps were updated.MAppPrint also performed much better than other methods under regional disparities and network changes.Source: D. Robustness Evaluation · p. 11, Table IX · p. 11
  • 5% precision degradation under 30% packet out-of-order or flow loss; MAppPrint had the least degradation across tested failures.Its fingerprint representations also showed greater stability than other methods under concept drift and regional change.Source: Figure 7 · p. 11, D. Robustness Evaluation · p. 11

E. Efficiency Evaluation

  • Compression changed precision by only a 0.9% decrease on SIM-APP and increases of 0.2%, 1.5%, and 0.4% on the other three datasets.For MAPP and SAMF, compression ratios of 40–80% increased throughput by 22–25 times with only a 0.2–0.9% precision decrease.Source: Figure 10 · p. 12, E. Efficiency Evaluation · p. 12
  • 10.54 GB/s average throughput; TBCG compression improved MAppPrint’s throughput by approximately 25 times.At 30 MB/s wireless speed, one laptop could simultaneously monitor approximately 360 users’ mobile devices.Source: E. Efficiency Evaluation · p. 11, Figure 8 · p. 12
  • 0.68s average prediction latency, comprising 0.60s for TBCG construction and 0.08s for compression.At a 30s collection window, prediction latency is much shorter than the window; at 30s latency, MAppPrint achieved at least 65.2% higher throughput and 6.2% higher precision than other methods.Source: Figure 8 · p. 12, E. Efficiency Evaluation · p. 12
  • TBCG compression reduced nodes by 37.5–81.5%, edges by 31.0–61.3%, identification FLOPs by 38.4–81.8%, and memory use by 38.1–85.1%.The reductions in FLOPs and memory apply to the app identification step.Source: Figure 9 · p. 12, E. Efficiency Evaluation · p. 12

VI. DISCUSSION

The discussion evaluates MAppPrint across activity, generalized, and open-world fingerprinting, addresses deployment limits and countermeasures, and places the method among related work. The conclusion summarizes its three designs and reported overall performance.

VI. DISCUSSION

  • MAppPrint leads other methods by over 5% in in-app activity identification, reaches an F1 score of up to 98.5% for certain activities, and performs best across generalized traffic fingerprinting tasks.The generalized tasks use X-Web, IoT-SENTINEL, and USTC-TFC.Source: §VI · p. 12
  • In open-world testing, MAppPrint remains effective despite a slight performance decrease, using repeated subgraph separation and target-app checks to classify rejected traces.Rejected traces are decomposed into TBCG subgraphs, which are checked individually for target-app traffic.Source: §VI · p. 13
  • Shared services can make traffic ambiguous; limited misclustering during multi-app separation does not necessarily misidentify apps, but highly ambiguous conditions remain future work.The system identifies apps from reconstructed TBCGs rather than individual flows.Source: §VI · p. 13
  • With 2–4 devices active behind NAT, precision is 75.7–81.6%, a drop of 11.3–17.3%; fingerprinting fails when the same app runs simultaneously on different devices.The method is designed for deployment before NAT, where flows from different devices can be separated in advance.Source: §VI · p. 13
  • Packet injection provides the best defense among the evaluated shaping techniques by altering local traffic patterns and disrupting their correlations; defenses can add bandwidth overhead and latency.The evaluated techniques are packet padding, delaying, and injection; encrypted tunnels can also hide correlations among original flows.Source: §VI · p. 13

VII. RELATED WORK

  • Prior AF work includes single-flow fingerprints,,, and multi-flow correlation or interaction graphs,,,,; the paper identifies dynamic-environment fragility, limited timeliness, and multi-app handling as remaining issues.Multi-tab website fingerprinting,, assumes a preset number of websites, which the paper describes as impractical for realistic AF.Source: §VII · p. 13

VIII. CONCLUSION

  • MAppPrint combines behavior-level TBCGs, TBCG compression, and unified single- and multi-app identification; the conclusion reports higher precision and timeliness, robustness in dynamic networking, and efficient online analysis.The conclusion characterizes its experimental results as significantly better than existing methods without giving numerical values here.Source: §VIII · p. 14

ETHICAL CONSIDERATIONS

  • The study avoided human subjects through a traffic triggering system, removed sensitive content and anonymized payloads, and subjected code and data use to review and oversight.The paper also discusses countermeasures and efforts to minimize potential risks and harms.Source: ETHICAL CONSIDERATIONS · p. 14

APPENDIX A DETAILS OF IMPLEMENTATION

The appendix describes extracting unit traffic behaviors from traces, vectorizing each behavior, and constructing a directed acyclic TBCG from the resulting behavior set.

A. Unit Traffic Behavior Extraction

  • Algorithm 1 segments a traffic trace into unit traffic behaviors after grouping packets into bidirectional flows.The algorithm takes a traffic trace and packet inter-arrival time threshold as input and outputs a set of unit traffic behaviors.Source: A. Unit Traffic Behavior Extraction · p. 15

B. Unit Traffic Behavior Features

C. TBCG Construction

  • Algorithm 2 transforms a unit traffic behavior set into a directed acyclic graph, the Traffic Behavior Correlation Graph.The stated output is a directed acyclic graph G.Source: C. TBCG Construction · p. 15

D. Training of Single-App Classifiers

The supplied passages identify an algorithm for training one-vs-rest single-app classifiers and provide its input/output labels and an ordering step.

D. Training of Single-App Classifiers

E. Subgraph Features

The section describes subgraph feature construction and the system used to generate and label traffic. Subgraphs are represented by 10-dimensional feature vectors, while packet labels are obtained by matching logged identifiers and five-tuples to captured packets.

E. Subgraph Features

A. Traffic Triggering and Labeling System

  • The traffic-labeling system uses a laptop-based user simulator and labeler alongside smartphone-based traffic triggering and data collection.The system records app UIDs and five-tuples, mirrors packets into PCAP files, then matches the logged invocation relationships to packet five-tuples for packet-level labels.Source: A. Traffic Triggering and Labeling… · p. 16
  • The user simulator converts activities into Android commands and sends them through ADB; Monkey activates the corresponding apps and in-app components.The activities are combined and repeated to simulate continuous user interactions.Source: A. Traffic Triggering and Labeling… · p. 16

B. Model Architecture and Hyper-parameters Selection

The classifier uses a GNN with two stacked GAT layers, graph pooling, and an output layer, with training hyper-parameters selected by grid search. Appendix C presents additional analyses and comparisons spanning traffic mixtures, robustness, and other fingerprinting tasks.

B. Model Architecture and Hyper-parameters Selection

APPENDIX C ADDITIONAL EXPERIMENTAL RESULTS

  • Appendix C presents analyses of traffic proportions across concurrency scenarios, category-level false positives, compression-accuracy trade-offs, fingerprint stability, and countermeasures.Figure 14 identifies K/|V| ∈ [0.1, 0.2] as providing a good balance between TBCG compression ratio and fingerprinting accuracy on MAPP and SAMF.Source: Figure 12 · p. 17, Figure 13 · p. 17, Figure 14 · p. 17
  • Appendix C also reports comparisons of single-/multi-app differentiation at different traffic mixing ratios and throughput, precision, and F1 at a 30-second latency.The appendix includes tables on misclassified FOAP labels, in-app activity identification, website fingerprinting, IoT monitoring, and intrusion detection.Source: Table XIV · p. 17, Table XV · p. 17, Table XVI · p. 17
  • Appendix C includes TBCG ablations, closed- and open-world performance, and performance in a simulated NAT network.The closed-world dataset contains 94 target apps; the open-world dataset adds 906 FOAP non-target apps, while the NAT table compares settings with and without NAT.Source: Table XX · p. 18, Table XXI · p. 18, Table XXII · p. 18
Loading 2610.22148v1…