Pith. sign in

REVIEW 3 major objections 4 minor 50 references

X-PRINT:Platform-Agnostic and Scalable Fine-Grained Encrypted Traffic Fingerprinting

T0 review · 3 major / 4 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Backend URI invocation patterns are platform-agnostic invariants that let a passive observer infer fine-grained app behaviors from encrypted traffic, including for unseen platforms and apps.

desk verdict Genuinely new server-centric URI-map idea with solid cross-platform results, but the open-world generalization claim rests on an untested shared-URI overlap assumption. read the letter →

arxiv 2509.00706 v1 pith:BTW3AGZQ submitted 2025-08-31 cs.CR

YuKun Zhu , ManYuan Hua , Hai Huang , YongZhao Zhang , Jie Yang , FengHua Xu , RuiDong Chen , XiaoSong Zhang
show 2 more authors
JiGuo Yu Yong Ma
This is my paper
classification cs.CR
keywords encryptedtrafficfingerprintingfine-grainedbehavioridentificationbackendURIinvariantscross-platformgeneralizationopen-worldclassificationside-channelanalysiscanonicalmapssharedandprivateURIs
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

X-PRINT asks whether a network observer who cannot decrypt traffic can still tell which specific action a user took inside an app, even when that app runs on a platform or version never seen during training. The paper's answer is that backend URI invocation patterns—the sequence of server endpoints a behavior triggers—are stable across client platforms and leak through side channels like packet sizes, directions, and timings. It treats these URIs as the unit of analysis instead of client-interface events, trains classifiers in a local man-in-the-middle setup to recognize URI bursts from encrypted flows, and matches predicted URI sequences against canonical URI maps per behavior. For unseen apps, platforms, or versions, it drops platform-specific private URIs and matches on the shared URIs only, arguing this removes noise and keeps the anchors intact. A reader should care because, if right, fine-grained behavior inference becomes feasible at network scale without device access or decryption, and the same mechanism reveals what a countermeasure would need to break.

What carries the argument

Canonical URI Map (CUM): a per-behavior, per-application template of the most frequent ordered URI invocation sequences, grouped by destination domain. Matching compares a predicted URI map to CUMs using per-domain longest-common-subsequence alignment, per-URI confidence scores (gated at 0.5), and a coverage penalty for missing URIs. Supporting machinery: a local man-in-the-middle setup that labels encrypted flows with ground-truth URIs; burstification, which slices flows at inter-burst gaps (~500 ms) to turn URI invocations into classifiable units; random-forest burst classifiers that map 123-dimensional side-channel features to URI labels; and the shared/private URI split used in the unsee

What would settle it

Train on Android, iOS, and Windows for a set of behaviors, then test on the same app on a platform whose client uses a different API gateway or renamed endpoint paths. Measure the overlap of URI paths between the training platforms and the unseen platform; if that overlap is near zero, the paper's fine-grained behavior identification should collapse. A simpler check: the paper's own data shows shared-URI invocation frequency ranges from 30% to 89%, so an unseen platform at the low end is a direct stress test of the refinement.

Watch

Extended reading notes

Core claim

The paper's central discovery is that backend URIs are the right abstraction for cross-platform encrypted-traffic fingerprinting. Different clients of the same service talk to the same backend endpoints, so the same user behavior generates overlapping URI invocations across Android, iOS, and desktop; the paper measures shared-URI packet frequency between 30% and 89% depending on app and platform. These URI invocations leave side-channel traces in encrypted traffic, and the temporal order of URI bursts forms a canonical URI map per behavior. X-PRINT classifies bursts into URIs from side-channel features, then scores each candidate behavior by aligning the predicted URI sequence to a canonical

Load-bearing premise

The system assumes that the backend endpoints shared by the training platforms are the same endpoints an unseen platform, similar app, or updated version will still call; if the unseen target reroutes core functions to new endpoints, the shared-URI anchors disappear and the refinement has no signal.

Editorial extensions

If this is right

  • A passive observer at a network gateway can infer fine-grained app behaviors from encrypted traffic without device access or payload decryption, as long as the observed app has a backend URI structure.
  • Cross-platform generalization becomes profile-free: the same trained models and canonical maps transfer to unseen platforms, functionally similar apps, and major version updates, provided shared URIs persist.
  • The two-stage pipeline handles interleaved multi-user traffic by filtering at flow level and disambiguating overlapping activity windows at the URI-map level.
  • The server-centric unit of analysis removes the label ambiguity of client-side UI instrumentation, since identical-looking bursts no longer get different labels based on UI events.
  • Countermeasures would have to break the side-channel link between encrypted bursts and URI invocations rather than merely encrypting payloads.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If URI path structure, not the exact path string, is what stays shared across platforms, normalizing paths into templates before building CUMs would make the shared anchors more resilient to endpoint churn; the paper does not test this.
  • The shared/private URI split could be used as an a priori transferability estimate: computing expected shared-URI overlap between training platforms and a candidate target platform could predict whether X-PRINT-style inference will work before collecting target data.
  • The same technique could extend to IoT or set-top-box devices that reuse the same backends; the paper evaluates smart-TV migration as an unseen platform, so the next test is whether a radically different networking stack still produces burst-shaped URI invocations.
  • A service provider could break the shared anchors by giving each platform its own API gateway or versioned endpoint paths, making platform-agnostic fingerprinting an arms race with backend deployment choices.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper introduces X-PRINT, a server-centric framework for fine-grained encrypted-traffic fingerprinting. The key idea is that backend URI invocation patterns are platform-agnostic invariants: different clients of the same service (Android, iOS, Windows, SmartTV, etc.) invoke overlapping server-side URIs, and the temporal sequence of these invocations identifies user behaviors. The system is trained in a controlled MitM environment with decrypted URI labels, then applied to encrypted traffic using a two-stage pipeline: coarse-grained flow-level app filtering, followed by burst-level URI classification and matching against Canonical URI Maps (CUMs). For unseen applications, platforms, and versions, the paper proposes a refinement step that discards private URIs and matches only shared URIs. The evaluation reports large gains over APPScanner and FOAP in cross-platform and open-world settings, including unseen applications, unseen platforms, and version drift, plus a human-operator transfer experiment.

Significance. If the central invariance claim holds, this is a significant advance: it offers a way to do fine-grained behavior inference across platforms without client-side instrumentation and with some open-world scalability. The strengths of the paper are the breadth of the evaluation (cross-platform, unseen platform, unseen app, version drift, human-transfer), the use of direct URI-level ground truth from a controlled MitM setup, and the temporally structured matching that goes beyond single-label classification. The main advertised capability—generalizing to unseen applications and platforms via shared URIs—is, however, supported only indirectly, and one of the key hyperparameter choices is tuned on the evaluation set. These issues must be addressed before the central claims can be considered fully established.

major comments (3)
  1. [§5.4.3, §6.3.3, Tables 1, 3, 8] The refinement step for unseen applications is load-bearing for the open-world scalability claim. Section 5.4.3 states that for any unseen case one can 'simply identify the shared URIs from cross-platform applications in the training set' and match only those, and Section 6.3.3 reports F1 ≈ 0.74–0.77 for 10 unseen apps per category. Yet nothing in the evaluation measures whether the held-out apps actually invoke the training-derived shared URIs. Tables 1 and 3 show that shared-URI frequency ranges from 30% to 89% and that CUMs differ sharply across platforms, so the overlap is not an invariant. If the selected unseen apps happen to share providers or SDKs with the training apps, Table 8 largely measures near-duplicate backend detection rather than generalization to genuinely different backends. I would like to see, for each unseen test app, the fraction of invoked URI paths that appear i
  2. [§6.3.1, Figure 7, Eq. (1)] The hyperparameters λ and β are tuned on the same data used to report detection performance. In §6.3.1, a grid search over λ ∈ [0.2,2] and β ∈ [0.1,0.9] selects λ=1, β=0.3 by maximizing F1 on a 40-app dataset that is then used for the unseen-detection evaluation. No separate validation set or nested cross-validation is described. Because λ and β directly determine Scoremap in Eq. (1) and the unseen tag in §5.4.2, the reported detection F1 is an optimistic selection result, not an unbiased estimate. Since the later unseen-platform/application/version experiments inherit these parameters, their reported gains may also be optimistic. Please add a held-out tuning procedure or a principled way to fix λ and β before evaluation, and report sensitivity of Tables 7–9 to these choices.
  3. [§3.3.1, Tables 1 and 2] The core 'platform-agnostic invariant' claim is partly self-confirming as presented. Shared URIs are defined in §3.3.1 as the intersection of URIs observed on the three platforms collected for training, and Table 2 then reports high DTW similarity for shared-URI flows across those same platforms. This confirms that the intersection is consistent on the platforms used to define it, but it does not test the invariant for genuinely unseen platforms. For the unseen-platform evaluation in Table 7 (SmartTV, iOS17), the paper does not report whether the target-platform traffic actually invokes the shared URIs from Android/iOS15/Windows, nor how the burst-level URI classifier behaves on target-platform traffic. At minimum, report URI-overlap statistics and URI-classification accuracy per target platform. Otherwise the strong generalization conclusion goes beyond the evidence.
minor comments (4)
  1. [§6.3] The text between 'These can be broadly divided into two categories' and Figure 7 contains a large block of corrupted Unicode/escape sequences (a long run of '/uni00000012/...'). This appears to be a damaged figure or text artifact and must be repaired before publication.
  2. [Appendix C, Table 11] The text says 'In A+H→H, X-PRINT attains perfect precision, recall, and F1', but Table 11 reports AH→H values of 0.973, 0.955, and 0.950, not 1.0. The prose and table are inconsistent and should be aligned.
  3. [Table 2] Only average DTW similarity scores are reported, without per-application variance or per-platform-pair detail. Given that Table 1 shows large variation in shared-URI frequency across applications, reporting only the average overstates the consistency.
  4. [Eq. (1), Algorithm 1] The denominator ∑_{u_j∈P} p_{u_j} uses confidence scores p_u_j, but for URIs in P that appear in the CUM but not in the predicted map, p_u_j is not defined. Please state explicitly that missing confidences are taken as 0, and clarify that the numerator's per-URI confidence is the maximum over predicted instances.

Circularity Check

1 steps flagged · score 4.0 of 10

One fitted threshold undermines the unseen-case detection claim; the core URI-map behavior identification is independently evaluated.

  1. fitted input called prediction [Section 6.3.1, 'Performance of Unseen Case Detection' and Figure 7]
    "To identify parameter values, we perform a grid search to determine the combination that yields the best detection performance. The evaluation is conducted on a dataset of 40 randomly selected applications, with 20 included in training (known) and 20 excluded from training (unseen). ... Based on these observations, we select λ = 1 and β = 0.3, which jointly maximize the F1-score for unseen case detection."

    The F1-score used as evidence for X-PRINT's ability to 'accurately detect the presence of unseen cases' is the very objective maximized by the grid search over λ and β on the same 20-known/20-unseen split. No separate validation or test set is used for this claim, so the reported detection performance is a fitted optimum rather than an independent prediction. The fitted thresholds then propagate into the open-world tables, making part of the scalability evidence for unseen-case detection forced by construction.

full rationale

X-PRINT is a supervised machine-learning pipeline; no equation-level derivation is claimed. The principal behavior-identification results (Tables 4, 6-9) are evaluated on held-out traffic instances, apps, platforms, and versions, so the central claim that URI-map matching enables fine-grained cross-platform identification is not a tautology and retains independent empirical content. The shared-URI construction (Sec. 3.3.1) defines shared URIs as the intersection observed across training platforms and later reuses that set for refinement (Sec. 5.4.3); this is a legitimate inductive feature choice, though the paper never directly measures whether unseen cases actually invoke those training-derived URIs, leaving a genuine generalization assumption. The one concrete circular step is the grid-search selection of λ and β on the same split used to report unseen-case detection F1; that sub-result is fitted rather than predicted and inflates the open-world detection claim. There are no load-bearing self-citations or imported uniqueness theorems.

Assumptions & free parameters 7 free parameters · 4 assumptions · 2 invented entities

The system is not a derivation; it is a supervised pipeline that imports several domain assumptions. Four are load-bearing: (1) URI patterns are stable invariants across platforms and versions, (2) side channels suffice to predict URIs, (3) time-based burstification isolates single URI requests, and (4) a local MitM corpus transfers to real traffic. Free parameters are all empirical thresholds, several selected on the evaluation data.

free parameters (7)
  • q (voting ratio for coarse-grained app filtering) = 0.8
    Section 5.2.2: empirically set to balance retaining target-like segments vs filtering irrelevant traffic.
  • pmin (per-flow similarity threshold) = 0.5
    Section 5.2.2: empirically set for the coarse-grained filter.
  • background flow acceptance gate = 0.95
    Section 5.3.1: acceptance threshold for the logistic flow-filtering model, described as an empirical gate.
  • inter-burst gap threshold Delta_t (epsilon) = 500 ms
    Section 5.3.2 and Table 5: chosen to maximize burst-level URI classification F1 on the evaluation set.
  • confidence gate tau = 0.5
    Algorithm 1 / Appendix B: fixed confidence gate for URI matching.
  • coverage penalty lambda = 1
    Section 6.3.1: selected by grid search on the unseen-case detection evaluation set.
  • unseen threshold beta = 0.3
    Section 6.3.1: selected by grid search on the unseen-case detection evaluation set to maximize F1.
assumptions (4)
  • domain assumption Backend URI invocation patterns are stable, shared across platforms, and discriminative of fine-grained behaviors.
    Sections 3.3 and 5.4.3: the core invariant that X-PRINT is built on; if shared URIs change with platform, version, or app, the refinement fails.
  • domain assumption Side-channel features (packet sizes, directions, timestamps) of encrypted traffic suffice to identify backend URIs.
    Section 5.3.3: URI classification model relies on this transferable mapping, learned in local MitM, applied to real traffic.
  • domain assumption A burst of packets with inter-arrival time below threshold epsilon corresponds to a single URI request.
    Section 5.3.2, Figure 4: burstification assumption; real-world multiplexing and jitter may violate it.
  • domain assumption The attacker can collect decrypted training data via a local MitM environment with cert-bypass tooling.
    Section 4 threat model; the authors themselves note anti-MitM defenses require manual intervention (Section 7).
invented entities (2)
  • Canonical URI Map (CUM)
    purpose: A per-behavior template of the most frequent URI invocation sequence, used as the matching target in fine-grained inference.
    An analytical construct derived from the authors' own training corpus; its cross-platform validity is the central empirical claim, so it has no independent falsifiable handle outside the paper.
  • Shared/private URI categories
    purpose: Partitions URIs into platform-agnostic shared anchors vs platform-specific private noise; refinement discards private URIs.
    Defined relative to the set of platforms in the training corpus; whether the partition persists for unseen platforms is an untested-forward assumption.

how reviews work

0 comments
Cite this review

Pith. "Pith review of X-PRINT:Platform-Agnostic and Scalable Fine-Grained Encrypted Traffic Fingerprinting." pith.science (2026). https://pith.science/paper/BTW3AGZQ

@misc{pith2026250900706,
  author       = {Pith},
  title        = {Pith review of: X-PRINT:Platform-Agnostic and Scalable Fine-Grained Encrypted Traffic Fingerprinting},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/BTW3AGZQ}},
  note         = {Machine review of arXiv:2509.00706}
}
read the original abstract

Although encryption protocols such as TLS are widely de-ployed,side-channel metadata in encrypted traffic still reveals patterns that allow application and behavior inference.How-ever,existing fine-grained fingerprinting approaches face two key limitations:(i)reliance on platform-dependent charac-teristics,which restricts generalization across heterogeneous platforms,and(ii)poor scalability for fine-grained behavior identification in open-world settings. In this paper,we present X-PRINT,the first server-centric,URI-based framework for cross-platform fine-grained encrypted-traffic fingerprinting.X-PRINT systematically demonstrates that backend URI invocation patterns can serve as platform-agnostic invariants and are effective for mod-eling fine-grained behaviors.To achieve robust identifica-tion,X-PRINT further leverages temporally structured URI maps for behavior inference and emphasizes the exclusion of platform-or application-specific private URIs to handle unseen cases,thereby improving reliability in open-world and cross-platform settings.Extensive experiments across diverse cross-platform and open-world settings show that X-PRINT achieves state-of-the-art accuracy in fine-grained fingerprint-ing and exhibits strong scalability and robustness.

Figures

Figures reproduced from arXiv: 2509.00706 by the authors.

Figure 1
Figure 1. Demonstrating the URI-based traffic analysis. (a) [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. The threat model of X-PRINT [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Overview of X-PRINT. In the controlled local MitM environment, attackers collect and analyze network traffic across different platforms using their own devices, training four models for real-world inference. Specifically, X-PRINT leverages flow-level features for coarse-grained app filtering and burst-level URIs as the analytical unit for fine-grained behavior inference. pi is low, whereas the variance between neigh… view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Flow burstification based on time intervals. [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: Comparison of client-side instrumentation for [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 7
Figure 7. Figure 7: Impact of coverage penalty λ and unseen threshold β on the F1-score for unseen application detection. Higher values indicate better performance. patterns, such as cross-platform migrations, application vari￾ants with high functional overlap, or updates to application v…

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

50 extracted references · 47 canonical work pages

  1. [1]

    Statistical application fingerprinting for ddos attack mitigation

    Muhammad Ejaz Ahmed, Saeed Ullah, and Hyoung- shick Kim. Statistical application fingerprinting for ddos attack mitigation. IEEE Transactions on Information Forensics and Security, 14(6):1471–1484, 2018

    work page 2018

  2. [2]

    Encrypted network traffic analysis and classification uti- lizing machine learning

    Ibrahim A Alwhbi, Cliff C Zou, and Reem N Alharbi. Encrypted network traffic analysis and classification uti- lizing machine learning. Sensors, 24(11):3509, 2024

    work page 2024

  3. [3]

    Machine learning for encrypted malware traffic classification: accounting for noisy labels and non-stationarity

    Blake Anderson and David McGrew. Machine learning for encrypted malware traffic classification: accounting for noisy labels and non-stationarity. In Proceedings of the 23rd ACM SIGKDD International Conference on knowledge discovery and data mining, pages 1723– 1732, 2017

    work page 2017

  4. [4]

    Network traffic prediction based on diffusion convolutional recurrent neural networks

    Davide Andreoletti, Sebastian Troia, Francesco Musumeci, Silvia Giordano, Guido Maier, and Massimo Tornatore. Network traffic prediction based on diffusion convolutional recurrent neural networks. In IEEE INFOCOM 2019-IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS) , pages 246–251. IEEE, 2019

    work page 2019

  5. [5]

    Spatializing Social Media: Social Net- works Online and Offline

    Marco Bastos. Spatializing Social Media: Social Net- works Online and Offline. Routledge, 2021

    work page 2021

  6. [6]

    Snowflake, a censorship circumvention system using temporary {WebRTC} proxies

    Cecylia Bocovich, Arlo Breault, David Fifield, Xiaokang Wang, et al. Snowflake, a censorship circumvention system using temporary {WebRTC} proxies. In 33rd USENIX Security Symposium (USENIX Security 24) , pages 2635–2652, 2024

    work page 2024

  7. [7]

    Man-in-the-middle (mitm) attack based hijack- ing of http traffic using open source tools

    Ankita R Chordiya, Subhrajit Majumder, and Ahmad Y Javaid. Man-in-the-middle (mitm) attack based hijack- ing of http traffic using open source tools. In 2018 IEEE International Conference on Electro/Information Technology (EIT), pages 0438–0443. IEEE, 2018

    work page 2018

  8. [8]

    A sur- vey of man in the middle attacks

    Mauro Conti, Nicola Dragoni, and Viktor Lesyk. A sur- vey of man in the middle attacks. IEEE communications surveys & tutorials, 18(3):2027–2051, 2016

    work page 2027

Show all 50 references
  1. [9]

    Trafficllm: Enhancing large language models for network traffic analysis with generic traffic representation

    Tianyu Cui, Xinjie Lin, Sijia Li, Miao Chen, Qilei Yin, Qi Li, and Ke Xu. Trafficllm: Enhancing large language models for network traffic analysis with generic traffic representation. arXiv preprint arXiv:2504.04222, 2025

    2025 arXiv

  2. [10]

    Characteriza- tion of encrypted and vpn traffic using time-related

    Gerard Draper-Gil, Arash Habibi Lashkari, Mohammad Saiful Islam Mamun, and Ali A Ghorbani. Characteriza- tion of encrypted and vpn traffic using time-related. In Proceedings of the 2nd international conference on in- formation systems security and privacy (ICISSP), pages 407–414, 2016

    2016

  3. [11]

    The new world of informa- tion and communication technologies: Global and re- gional trends

    George Cornel Dumitrescu. The new world of informa- tion and communication technologies: Global and re- gional trends. Knowledge Horizons. Economics, 6(4):17, 2014

    2014

  4. [12]

    Unmasking the internet: A survey of fine-grained network traffic analysis

    Yebo Feng, Jun Li, Jelena Mirkovic, Cong Wu, Chong Wang, Hao Ren, Jiahua Xu, and Yang Liu. Unmasking the internet: A survey of fine-grained network traffic analysis. IEEE Communications Surveys & Tutorials, 2025

    2025

  5. [13]

    Cross-network embeddings transfer for traffic analysis

    Luca Gioacchini, Marco Mellia, Luca Vassio, Idilio Drago, Giulia Milan, Zied Ben Houidi, and Dario Rossi. Cross-network embeddings transfer for traffic analysis. IEEE Transactions on Network and Service Manage- ment, 21(3):2686–2699, 2023

    2023

  6. [14]

    Utmobilenettraffic2021: A labeled public net- work traffic dataset

    Yuqiang Heng, Vikram Chandrasekhar, and Jeffrey G Andrews. Utmobilenettraffic2021: A labeled public net- work traffic dataset. IEEE Networking Letters, 3(3):156– 160, 2021

    2021

  7. [15]

    Shortor: Improving tor network latency via multi- hop overlay routing

    Kyle Hogan, Sacha Servan-Schreiber, Zachary Newman, Ben Weintraub, Cristina Nita-Rotaru, and Srinivas De- vadas. Shortor: Improving tor network latency via multi- hop overlay routing. In 2022 IEEE Symposium on Secu- rity and Privacy (SP), pages 1933–1952. IEEE, 2022

    2022

  8. [16]

    De-anonymisation attacks on tor: A survey.IEEE Communications Surveys & Tutorials, 23(4):2324–2350, 2021

    Ishan Karunanayake, Nadeem Ahmed, Robert Malaney, Rafiqul Islam, and Sanjay K Jha. De-anonymisation attacks on tor: A survey.IEEE Communications Surveys & Tutorials, 23(4):2324–2350, 2021

    2021

  9. [17]

    Mitm tool analysis for tls forensics

    Minju Kim, Yeonghun Shin, and Taeshik Shon. Mitm tool analysis for tls forensics. In2021 International Con- ference on Platform Technology and Service (PlatCon), pages 1–4. IEEE, 2021

    2021

  10. [18]

    Packet-level open-world app fingerprinting on wireless traffic

    Jianfeng Li, Shuohan Wu, Hao Zhou, Xiapu Luo, Ting Wang, Yangyang Liu, and Xiaobo Ma. Packet-level open-world app fingerprinting on wireless traffic. In The 2022 Network and Distributed System Security Sym- posium (NDSS’22), 2022

    2022

  11. [19]

    {FOAP}:{Fine- Grained}{Open-World} android app fingerprinting

    Jianfeng Li, Hao Zhou, Shuohan Wu, Xiapu Luo, Ting Wang, Xian Zhan, and Xiaobo Ma. {FOAP}:{Fine- Grained}{Open-World} android app fingerprinting. In 31st USENIX Security Symposium (USENIX Security 22), pages 1579–1596, 2022

    2022

  12. [20]

    Et-bert: A contextualized data- gram representation with pre-training transformers for encrypted traffic classification

    Xinjie Lin, Gang Xiong, Gaopeng Gou, Zhen Li, Jun- zheng Shi, and Jing Yu. Et-bert: A contextualized data- gram representation with pre-training transformers for encrypted traffic classification. In Proceedings of the ACM Web Conference 2022, pages 633–642, 2022. 14

    2022

  13. [21]

    Protecting privacy on mobile apps: A principal–agent perspective

    Zilong Liu, Xuequn Wang, Xiaohan Li, and Jun Liu. Protecting privacy on mobile apps: A principal–agent perspective. ACM Transactions on Computer-Human Interaction (TOCHI), 29(1):1–32, 2022

    2022

  14. [22]

    Ana- lyzing the semantic structure of network flow: a threat detection method with independent generalization ca- pabilities

    Yiqing Luo, Mingshu He, and Xiaojuan Wang. Ana- lyzing the semantic structure of network flow: a threat detection method with independent generalization ca- pabilities. IEEE Transactions on Network Science and Engineering, 2024

    2024

  15. [23]

    Pinpointing hidden iot devices via spatial-temporal traffic fingerprinting

    Xiaobo Ma, Jian Qu, Jianfeng Li, John CS Lui, Zhen- hua Li, and Xiaohong Guan. Pinpointing hidden iot devices via spatial-temporal traffic fingerprinting. In IEEE INFOCOm 2020-IEEE conference on computer communications, pages 894–903. IEEE, 2020

    2020

  16. [24]

    Channel-combination algorithms for robust distant voice activity and overlapped speech detection

    Théo Mariotte, Anthony Larcher, Silvio Montrésor, and Jean-Hugh Thomas. Channel-combination algorithms for robust distant voice activity and overlapped speech detection. IEEE/ACM Transactions on Audio, Speech, and Language Processing, 32:1859–1872, 2024

    2024

  17. [25]

    Packet-level prediction of mobile-app traf- fic using multitask deep learning

    Antonio Montieri, Giampaolo Bovenzi, Giuseppe Aceto, Domenico Ciuonzo, Valerio Persico, and Antonio Pescapè. Packet-level prediction of mobile-app traf- fic using multitask deep learning. Computer Networks, 200:108529, 2021

    2021

  18. [26]

    Large-scale mobile traffic analysis: a survey

    Diala Naboulsi, Marco Fiore, Stephane Ribot, and Raz- van Stanica. Large-scale mobile traffic analysis: a survey. IEEE Communications Surveys & Tutorials, 18(1):124– 161, 2015

    2015

  19. [27]

    Do mobile device and mobile app inno- vations trigger lifestylisations? insights from consumers in developing countries

    Raphael Odoom. Do mobile device and mobile app inno- vations trigger lifestylisations? insights from consumers in developing countries. Qualitative Market Research: An International Journal, 25(4):532–550, 2022

    2022

  20. [28]

    Radiovad: mmwave-based noise and interference-resilient voice activity detection

    Muhammed Zahid Ozturk, Chenshu Wu, Beibei Wang, Min Wu, and KJ Ray Liu. Radiovad: mmwave-based noise and interference-resilient voice activity detection. IEEE Internet of Things Journal, 11(15):26005–26019, 2024

    2024

  21. [29]

    Visual voice activity detection in the wild

    Foteini Patrona, Alexandros Iosifidis, Anastasios Tefas, Nikolaos Nikolaidis, and Ioannis Pitas. Visual voice activity detection in the wild. IEEE Transactions on Multimedia, 18(6):967–977, 2016

    2016

  22. [30]

    Racing for{TLS} certificate validation: A hijacker’s guide to the android {TLS} galaxy

    Sajjad Pourali, Xiufen Yu, Lianying Zhao, Mohammad Mannan, and Amr Youssef. Racing for{TLS} certificate validation: A hijacker’s guide to the android {TLS} galaxy. In 33rd USENIX Security Symposium (USENIX Security 24), pages 683–700, 2024

    2024

  23. [31]

    Context-aware behavioral finger- printing of iot devices via network traffic analysis

    Arjun Prasad, Kevin Kanichery Biju, Soumya Somani, and Barsha Mitra. Context-aware behavioral finger- printing of iot devices via network traffic analysis. In SECRYPT, pages 335–344, 2023

    2023

  24. [32]

    An inter- national view of privacy risks for mobile apps, 2019

    Jingjing Ren, D Dubois, and David Choffnes. An inter- national view of privacy risks for mobile apps, 2019

    2019

  25. [33]

    A comparative study of divisive and ag- glomerative hierarchical clustering algorithms

    Maurice Roux. A comparative study of divisive and ag- glomerative hierarchical clustering algorithms. Journal of Classification, 35(2):345–366, 2018

    2018

  26. [34]

    Eavesdropping on {Fine- Grained} user activities within smartphone apps over encrypted network traffic

    Brendan Saltaformaggio, Hongjun Choi, Kristen John- son, Yonghwi Kwon, Qi Zhang, Xiangyu Zhang, Dongyan Xu, and John Qian. Eavesdropping on {Fine- Grained} user activities within smartphone apps over encrypted network traffic. In 10th USENIX workshop on offensive technologies ...

    2016

  27. [35]

    Anomaly detection in encrypted network traffic us- ing self-supervised learning

    Sadaf Sattar, Shumaila Khan, Muhammad Ismail Khan, Ainur Akhmediyarova, Orken Mamyrbayev, Dinara Kassymova, Dina Oralbekova, and Janna Alimkulova. Anomaly detection in encrypted network traffic us- ing self-supervised learning. Scientific Reports , 15(1):26585, 2025

    2025

  28. [36]

    Toward generating a new intrusion detection dataset and intrusion traffic characterization

    Iman Sharafaldin, Arash Habibi Lashkari, and Ali A Ghorbani. Toward generating a new intrusion detection dataset and intrusion traffic characterization. ICISSP, pages 108–116, 2018

    2018

  29. [37]

    Fine-grained webpage fingerprinting using only packet length information of encrypted traf- fic

    Meng Shen, Yiting Liu, Liehuang Zhu, Xiaojiang Du, and Jiankun Hu. Fine-grained webpage fingerprinting using only packet length information of encrypted traf- fic. IEEE Transactions on Information Forensics and Security, 16:2046–2059, 2020

  30. [38]

    Mobile health and privacy: cross sectional study

    Gioacchino Tangari, Muhammad Ikram, Kiran Ijaz, Mo- hamed Ali Kaafar, and Shlomo Berkovsky. Mobile health and privacy: cross sectional study. bmj, 373, 2021

    2021

  31. [39]

    A comparative analysis of trajectory similarity measures

    Yaguang Tao, Alan Both, Rodrigo I Silveira, Kevin Buchin, Stef Sijben, Ross S Purves, Patrick Laube, Dongliang Peng, Kevin Toohey, and Matt Duckham. A comparative analysis of trajectory similarity measures. GIScience & Remote Sensing, 58(5):643–669, 2021

    2021

  32. [40]

    Taylor, Riccardo Spolaor, Mauro Conti, and Ivan Martinovic

    Vincent F. Taylor, Riccardo Spolaor, Mauro Conti, and Ivan Martinovic. Appscanner: Automatic fingerprint- ing of smartphone apps from encrypted network traffic. IEEE, 2016

    2016

  33. [41]

    Robust smartphone app identification via encrypted network traffic analysis

    Vincent F Taylor, Riccardo Spolaor, Mauro Conti, and Ivan Martinovic. Robust smartphone app identification via encrypted network traffic analysis. IEEE Transac- tions on Information Forensics and Security, 13(1):63– 78, 2017. 15

    2017

  34. [42]

    Large-scale network-traffic-identification method with domain adaptation

    Shun Tobiyama, Bo Hu, Kazunori Kamiya, and Kenji Takahashi. Large-scale network-traffic-identification method with domain adaptation. In Companion Pro- ceedings of the Web Conference 2020, pages 109–110, 2020

    2020

  35. [43]

    A survey of methods for encrypted traffic classi- fication and analysis

    Petr Velan, Milan ˇCermák, Pavel ˇCeleda, and Martin Drašar. A survey of methods for encrypted traffic classi- fication and analysis. International Journal of Network Management, 25(5):355–374, 2015

    2015

  36. [44]

    Profiledroid: multi-layer profiling of android applications

    Xuetao Wei, Lorenzo Gomez, Iulian Neamtiu, and Michalis Faloutsos. Profiledroid: multi-layer profiling of android applications. In Proceedings of the 18th Annual International Conference on Mobile Computing and Net- working, Mobicom ’12, page 137–148, New York, NY , USA, 2012....

    2012

  37. [45]

    Seeing traffic paths: Encrypted traffic classification with path signature features

    Shi-Jie Xu, Guang-Gang Geng, Xiao-Bo Jin, Dong-Jie Liu, and Jian Weng. Seeing traffic paths: Encrypted traffic classification with path signature features. IEEE Transactions on Information Forensics and Security , 17:2166–2181, 2022

    2022

  38. [46]

    Layout and image recognition driving cross- platform automated mobile testing

    Shengcheng Yu, Chunrong Fang, Yexiao Yun, and Yang Feng. Layout and image recognition driving cross- platform automated mobile testing. In 2021 IEEE/ACM 43rd International Conference on Software Engineering (ICSE), pages 1561–1571. IEEE, 2021

    2021

  39. [47]

    Predicted packet padding for anonymous web browsing against traffic analysis attacks

    Shui Yu, Guofeng Zhao, Wanchun Dou, and Simon James. Predicted packet padding for anonymous web browsing against traffic analysis attacks. IEEE Transac- tions on Information Forensics and Security, 7(4):1381– 1393, 2012

    2012

  40. [48]

    Defeating traffic analysis via differential privacy: a case study on streaming traffic

    Xiaokuan Zhang, Jihun Hamm, Michael K Reiter, and Yinqian Zhang. Defeating traffic analysis via differential privacy: a case study on streaming traffic. International Journal of Information Security, 21(3):689–706, 2022

    2022

  41. [49]

    Metarocketc: Adaptive encrypted traffic classification in complex network environments via time series analysis and meta-learning

    Jianjin Zhao, Qi Li, Yueping Hong, and Meng Shen. Metarocketc: Adaptive encrypted traffic classification in complex network environments via time series analysis and meta-learning. IEEE Transactions on Network and Service Management, 21(2):2460–2476, 2024

    2024

  42. [50]

    Libspector: Context-aware large-scale network traffic analysis of android applications

    Onur Zungur, Gianluca Stringhini, and Manuel Egele. Libspector: Context-aware large-scale network traffic analysis of android applications. In 2020 50th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN) , pages 318–330. IEEE, 2020. 16 A Applica...

    2020

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.