Pith. sign in

REVIEW 2 major objections 5 minor 51 references

Your Smart Home Can't Keep a Secret: Towards Automated Fingerprinting of IoT Traffic with Neural Networks

T0 review · 2 major / 5 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims that a bidirectional LSTM can identify which IoT device generated each packet from metadata alone, even when NAPT or VPN merges and obscures the traffic.

desk verdict LSTM-based IoT fingerprinting under NAPT is credible, but the VPN evaluation rests on a self-referential labeling heuristic and a likely temporal leakage; the headline numbers need an independent check before I'd believe them. read the letter →

arxiv 1909.00104 v1 pith:SG2LBSHK submitted 2019-08-31 cs.CR

Shuaike Dong , Zhou Li , Di Tang , Jiongyi Chen , Menghan Sun , Kehuan Zhang This is my paper · ORCID
classification cs.CR
keywords IoTsecuritytrafficanalysisdevicefingerprintingLSTMbidirectionalNAPTVPNsmarthomeprivacy
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that a smart home's IoT devices can be fingerprinted from encrypted network traffic even when the gateway uses NAPT or VPN to merge and obscure the traffic. It argues that a bidirectional LSTM trained on windows of consecutive packets can learn device-specific temporal patterns that survive this merging. Reported accuracy reaches 99.2% under NAPT and 97.7% under VPN for ten IoT devices, and 92.1% and 81.0% when concurrent non-IoT devices add noise. If this is right, a passive remote eavesdropper can identify which devices are installed and active without decrypting anything.

What carries the argument

The central object is the bidirectional LSTM applied to traffic windows: a traffic window is a sliding group of n consecutive packets (n=100), each represented by a vector of destination port, protocol bits, direction, frame length, and time interval. The BLSTM reads the window forward and backward, and a softmax layer predicts the device for every packet. This carries the argument because it turns packet dependency—the structured temporal sequence in which a device emits packets—into a classification signal that remains when NAPT or VPN erases per-device fields such as source IP and destination port.

What would settle it

Collect a VPN trace in which true per-device labels are known by an independent means—for example, run each device through a separate VPN session or mark packets before encapsulation—and evaluate the same BLSTM model; if the independently labeled accuracy falls below the reported 97.7% (and 81.0% in the noisy case), the claimed attack strength is inflated. Also directly measure the claimed 98.8% packet-pairing rate against this independent ground truth.

Watch

Extended reading notes

Core claim

The central discovery is that the temporal ordering, timing, and size of packets carry a stable device-specific fingerprint that survives NAPT and VPN tunneling. Using only per-packet metadata—destination port, protocol flags, direction, frame length, and time interval to the previous packet—the system HomeMole groups packets into windows of 100 and trains a bidirectional LSTM to label each packet with its source device. In the clean setting the model reaches 99.2% accuracy under NAPT and 97.7% under VPN; with concurrent non-IoT traffic it reaches 92.1% and 81.0%. The paper argues this outperforms random forest and shows that context from later packets helps distinguish devices like Echo Dot and Google Home that send identical 66-byte packets but receive different response sizes.

Load-bearing premise

The VPN results stand on the assumption that each encrypted packet was correctly matched back to the device that sent it using only packet size and a 0.02-second time window; if that matching is wrong, the reported VPN accuracy is not a valid measure of the attack.

Editorial extensions

If this is right

  • A passive eavesdropper on the WAN side of a home gateway can identify IoT device types per packet without decryption.
  • NAPT and VPN are not sufficient privacy defenses against device fingerprinting because packet timing and size sequences remain observable.
  • Per-packet classification can run online and can expose activity states, such as whether a camera is actively streaming or idle.
  • Larger traffic windows improve accuracy, so longer observation periods give an attacker a more reliable fingerprint.
  • Low-volume devices like smart plugs are the weak point, especially under VPN, because their few packets are diluted by other devices' traffic.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If temporal correlation is the real carrier of the fingerprint, defenses such as packet padding, traffic shaping, or randomized timing and sizes would protect privacy more than encryption alone; the paper does not test these.
  • A natural extension the paper leaves open is behavior-state inference—distinguishing camera streaming from idle, or user commands from background heartbeats—using the same windowed sequence model.
  • The VPN accuracy figures rest on a labeling heuristic, so the next test should be run with labels known before encapsulation; a mismatch would suggest the true VPN attack accuracy could be lower than reported.
  • The same approach could be tried against other traffic-reshaping middleboxes like proxies or anonymity networks; whether the fingerprint survives there remains open.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 5 minor

Summary. The paper proposes HomeMole, a packet-level IoT device fingerprinting system based on LSTM and bidirectional LSTM models, and evaluates it against a Random Forest baseline in NAPT and VPN gateway configurations, in both pure-IoT and noisy multi-device scenarios. The authors collect a real-device dataset of 10 IoT and 4 non-IoT devices, extract metadata features (destination port, protocol bits, direction, frame length, time interval), group consecutive 100-packet windows, and report high per-packet classification accuracies, e.g., 99.2% and 97.7% for bidirectional LSTM in pure-IoT NAPT and VPN, and 92.1% and 81.0% in the noisy scenarios. The central claim is that a remote adversary can identify device types from encrypted, NAPT/VPN-morphed traffic by exploiting temporal packet dependencies, a threat not addressed by prior IoT fingerprinting works.

Significance. If the reported results are valid, the paper would make a meaningful contribution to IoT privacy research by demonstrating that common gateway-level protections like NAPT and VPN do not prevent device identification, and that temporal sequence models outperform hand-crafted feature classifiers in these settings. The study uses a real testbed with 14 devices, defines a plausible remote-adversary model, and compares against a standard baseline. The packet-level classification is a useful design choice for online inference. However, the quantitative claims rest on two evaluation-protocol issues: a VPN label-generation heuristic that shares features with the classifier, and an underspecified train/test split that may allow temporal leakage. These issues are load-bearing because they call into question every headline accuracy figure, not just secondary results. The authors promise public release of datasets and models, which is commendable but not yet fulfilled in the arXiv version.

major comments (2)
  1. [Section 3.3 (Packet labeling)] The VPN ground-truth labels are constructed by a heuristic that pairs each tunneled packet with a pre-VPN packet of smaller size within a 0.02 s time window, and the claimed 98.8% pairing accuracy is stated without any independent ground truth or error analysis. Because the LSTM classifier is trained on the same frame-length and time-interval features used by this pairing heuristic, the reported VPN accuracies (Table 4: 97.7% pure-IoT; Figures 15-16: 81.0% noisy) may partly reflect a selection bias introduced by the label-generation process rather than intrinsic, device-specific traffic patterns. The authors should validate the pairing against a trusted ground-truth source (e.g., per-device capture before encapsulation at the VPN client) and re-evaluate all VPN results using only labels verified that way.
  2. [Section 4.1 (Experiment Settings)] The paper states that each dataset is split 8:2 with 5-fold cross-validation, but it never specifies the stride used to build the 100-packet traffic windows or requires training and testing windows to come from disjoint time intervals. If windows are extracted with a sliding stride, neighboring windows share 99 of 100 packets, and the phrase 'randomly-selected samples' for Dataset-Ind suggests exactly such overlapping sampling; a random 80/20 split would then place near-duplicate windows in both training and test sets. This temporal leakage can inflate every reported accuracy, including the NAPT numbers that are not affected by the VPN-labeling issue. Please specify the window stride and, crucially, re-run the evaluation with a time-based split (e.g., train on an early capture period and test on a later period) or otherwise guarantee that no packet appears in both training and test windows.
minor comments (5)
  1. [Section 2.4 and Section 2.6] The 'Adversary Model' subsection appears twice, verbatim; one copy should be removed.
  2. [Section 4.1] The phrase 'split each dataset with the training and testing ratio of 8:2 and conduct 5-fold cross-validation' conflates a single holdout split with 5-fold CV; please clarify the exact cross-validation protocol.
  3. [Section 3.2] There is a typo, 'analsyis' for 'analysis' in the first paragraph of the data collection description.
  4. [Section 1 (Contributions)] The paper promises to release datasets and models, but no repository is provided in the arXiv version; please either provide the link or state where and when the release will be available.
  5. [Section 4.2.2] Figure 8 shows accuracy increasing with window size up to 100, but the paper does not justify stopping at 100; a brief comment on whether larger windows were tested or why 100 was chosen would strengthen the hyperparameter discussion.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the VPN label-matching step and the LSTM input features overlap, but the paper's device-identification claim is not equivalent to its inputs by construction.

full rationale

The paper's derivation chain is a supervised-learning pipeline: raw packet captures are labeled from device identity, converted to feature vectors, grouped into windows, and used to train LSTM classifiers whose accuracy is then reported on held-out windows. No fitted parameter is renamed as a prediction, and no self-citation is load-bearing. The VPN packet-labeling algorithm (Section 3.3) uses packet size and a 0.02-second time window to link tunneled packets to pre-VPN packets, and the classifier does use frame length and time interval as features; however, the labels are not defined as the classifier's output, and the matching heuristic is not itself the claimed prediction. The paper reports a pairing rate of 98.8% as a separate preprocessing-quality measure rather than as the attack accuracy. The absence of a stated window stride or time-based split could permit temporal leakage, but the text does not establish that train and test windows share packets, so this is an experimental-validity concern, not a construction-level circularity. The central result therefore stands as an empirical claim about LSTM-based classification rather than a derivation that collapses into its inputs.

Assumptions & free parameters 10 free parameters · 4 assumptions · 0 invented entities

HomeMole adds no new physical entities or forces. The substantive assumptions are the VPN re-association heuristic and the representativeness of the lab testbed, along with the model and data-processing hyperparameters listed above.

free parameters (10)
  • Traffic window size n = 100
    Number of consecutive packets grouped for each classification step; chosen after comparing 20, 40 and 100 in Section 4.2.2.
  • LSTM hidden dimension = 64
    Capacity of the recurrent layer, set in Table 3.
  • LSTM embedding dimension = 30
    Dimension of the dport embedding, set in Table 3.
  • LSTM dropout rate = 0.5
    Regularization strength, set in Table 3.
  • LSTM learning rate = 0.001
    Adam optimizer step size, set in Table 3.
  • LSTM training epochs = 15
    Training duration, set in Table 3.
  • PCA components for one-hot dport = 50
    Dimensionality reduction for the baseline RF; retains 98.9% of port variance (Section 3.4.1).
  • Random forest tree count = 100
    Baseline model size chosen for speed/performance trade-off (Section 3.4.1).
  • VPN matching time window = 0.02 s
    Assumed maximum VPN-induced delay used to pair tunneled and original packets (Section 3.3).
  • Per-device sample cap = 5000
    Caps Dataset-Ind samples per device to balance classes; some devices have fewer (Section 4.1).
assumptions (4)
  • domain assumption A passive adversary can observe traffic on the WAN side between gateway and remote service.
    Defined in Section 2.4; the attack is only meaningful under this observation model.
  • domain assumption The 10 IoT and 4 non-IoT devices in the lab are representative of broader smart-home populations.
    Section 3.2 describes the testbed; accuracy generalization to unseen devices is assumed, not tested.
  • ad hoc to paper VPN tunneled packets can be re-associated with their source device using packet size and a 0.02 s timing window.
    Section 3.3 introduces this heuristic; the entire VPN-labeled dataset rests on it and its 98.8% accuracy is not independently verified.
  • domain assumption Packet metadata (frame length, inter-packet timing, dport, protocol, direction) contains sufficient signal for device identification after NAPT/VPN.
    This is the central modeling premise of the fingerprinting framework (Section 3.3).

how reviews work

0 comments
Cite this review

Pith. "Pith review of Your Smart Home Can't Keep a Secret: Towards Automated Fingerprinting of IoT Traffic with Neural Networks." pith.science (2026). https://pith.science/paper/SG2LBSHK

@misc{pith2026190900104,
  author       = {Pith},
  title        = {Pith review of: Your Smart Home Can't Keep a Secret: Towards Automated Fingerprinting of IoT Traffic with Neural Networks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/SG2LBSHK}},
  note         = {Machine review of arXiv:1909.00104}
}
read the original abstract

The IoT (Internet of Things) technology has been widely adopted in recent years and has profoundly changed the people's daily lives. However, in the meantime, such a fast-growing technology has also introduced new privacy issues, which need to be better understood and measured. In this work, we look into how private information can be leaked from network traffic generated in the smart home network. Although researchers have proposed techniques to infer IoT device types or user behaviors under clean experiment setup, the effectiveness of such approaches become questionable in the complex but realistic network environment, where common techniques like Network Address and Port Translation (NAPT) and Virtual Private Network (VPN) are enabled. Traffic analysis using traditional methods (e.g., through classical machine-learning models) is much less effective under those settings, as the features picked manually are not distinctive any more. In this work, we propose a traffic analysis framework based on sequence-learning techniques like LSTM and leveraged the temporal relations between packets for the attack of device identification. We evaluated it under different environment settings (e.g., pure-IoT and noisy environment with multiple non-IoT devices). The results showed our framework was able to differentiate device types with a high accuracy. This result suggests IoT network communications pose prominent challenges to users' privacy, even when they are protected by encryption and morphed by the network gateway. As such, new privacy protection methods on IoT traffic need to be developed towards mitigating this new issue.

Figures

Figures reproduced from arXiv: 1909.00104 by the authors.

Figure 2
Figure 2. VPN-enabled gateway. identifiers like destination IP address and destination port numbers of inbound packets[39]. For outbound packets, the source IP address and the source port are translated. In both cases, the IP address of a local device is replaced with the gateway’s IP address. The gateway using NAPT holds a translation table which records the mapping of addresses and ports so that packets will be routed to th… view at source ↗
Figure 3
Figure 3. Structure of a basic LSTM used in our work (FC [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figure 4
Figure 4. Proportion of collected packets. interact with the UI of mobile apps and trigger different functions of IoT devices. For devices like voice assistants directly controlled by human’s input, we replay the commands near them. For example, Google Home plays songs when it hears the command “sing a song”. We record a list of different commands and play them in a loop with a proper interval. As smart devices may have diffe… view at source ↗
Figures from the paper (7 more)
Figure 5
Figure 5. Figure 5: An example of traffic window. Embedding dimension LSTM hidden dimension LSTM layer Dropout rate 30 64 1 0.5 Learning rate Activation function Optimizer Training epochs 0.001 ReLU Adam 15 [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 7
Figure 7. Figure 7: Proportion of device combinations. (geq: greater [PITH_FULL_IMAGE:figures/full_fig_p008_7.png]
Figure 8
Figure 8. Figure 8: The impact of traffic window size (pure-IoT). [PITH_FULL_IMAGE:figures/full_fig_p009_8.png]
Figure 10
Figure 10. Figure 10: Performances of three models in VPN environ [PITH_FULL_IMAGE:figures/full_fig_p009_10.png]
Figure 11
Figure 11. Figure 11: Echo dot [PITH_FULL_IMAGE:figures/full_fig_p012_11.png]
Figure 13
Figure 13. Figure 13: Confusion matrix of RF (noisy+NAPT). echo google tmall xiaomi 360 tplink orvibomitu xiaobai broadlink non-IoT Predicted label echo google tmall xiaomi 360 tplink orvibo mitu xiaobai broadlink non-IoT True label 0.366 0.017 0.009 0.003 0.044 0.000 0.001 0.017 0.030 0.0…
Figure 15
Figure 15. Figure 15: Confusion matrix of BLSTM (noisy+NAPT). echo google tmall xiaomi 360 tplink orvibomitu xiaobai broadlink non-IoT Predicted label echo google tmall xiaomi 360 tplink orvibo mitu xiaobai broadlink non-IoT True label 0.702 0.006 0.007 0.001 0.008 0.000 0.000 0.008 0.004 …

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

51 extracted references · 34 canonical work pages

  1. [1]

    2017 Roundup Of Internet Of Things Fore- casts

    Accessed: March 2019. 2017 Roundup Of Internet Of Things Fore- casts. https://www.forbes.com/sites/louiscolumbus/2017/12/10/2017-roundup- of-internet-of-things-forecasts/

    work page 2019

  2. [2]

    AWS IoT Core

    Accessed: March 2019. AWS IoT Core. https://aws.amazon.com/cn/iot-core/

    work page 2019

  3. [3]

    Can a MAC address be traced? https://askleo.com/can_a_ mac_address_be_traced/

    Accessed: March 2019. Can a MAC address be traced? https://askleo.com/can_a_ mac_address_be_traced/

    work page 2019

  4. [4]

    Digital Ocean Droplets

    Accessed: March 2019. Digital Ocean Droplets. https://www.digitalocean.com/ products/droplets

    work page 2019

  5. [5]

    Monkeyrunner

    Accessed: March 2019. Monkeyrunner. https://developer.android.com/studio/ test/monkeyrunner

    work page 2019

  6. [6]

    OpenVPN over TCP vs

    Accessed: March 2019. OpenVPN over TCP vs. UDP: Which should I choose? https://www.bestvpn.com/guides/openvpn-tcp-vs-udp-difference-choose/

    work page 2019

  7. [7]

    Raspberry Pi

    Accessed: March 2019. Raspberry Pi. https://www.raspberrypi.org/ documentation/

    work page 2019

  8. [8]

    SmartThings Motion Sensor (2015 model)

    Accessed: March 2019. SmartThings Motion Sensor (2015 model). https://support.smartthings.com/hc/en-us/articles/205957580-SmartThings- Motion-Sensor-2015-model-

    work page arXiv 2019

Show all 51 references
  1. [9]

    Selcuk Uluagac

    Abbas Acar, Hossein Fereidooni, Tigist Abera, Amit Kumar Sikder, Markus Miet- tinen, Hidayet Aksu, Mauro Conti, Ahmad-Reza Sadeghi, and A. Selcuk Uluagac

  2. [10]

    Louis, and Mehmet Hadi Gunes

    Ahmet Aksoy, Sushil J. Louis, and Mehmet Hadi Gunes. 2017. Operating system fingerprinting via automated network traffic analysis. In 2017 IEEE Congress on Evolutionary Computation, CEC 2017, Donostia, San Sebastián, Spain, June 5-8,

    2017

  3. [11]

    Noah Apthorpe, Dillon Reisman, and Nick Feamster. 2017. A Smart Home is No Castle: Privacy Vulnerabilities of Encrypted IoT Traffic. CoRR abs/1705.06805 (2017). arXiv:1705.06805 http://arxiv.org/abs/1705.06805

    2017 arXiv

  4. [12]

    Noah Apthorpe, Dillon Reisman, Srikanth Sundaresan, Arvind Narayanan, and Nick Feamster. 2017. Spying on the Smart Home: Privacy Attacks and Defenses on Encrypted IoT Traffic. CoRR abs/1708.05044 (2017). arXiv:1708.05044 http: //arxiv.org/abs/1708.05044

    2017 arXiv

  5. [13]

    Jensen, and Brian Neil Levine

    George Dean Bissias, Marc Liberatore, David D. Jensen, and Brian Neil Levine

  6. [14]

    Tomasz Bujlow, Valentín Carela-Español, and Pere Barlet-Ros. 2015. Independent comparison of popular DPI tools for traffic classification. Computer Networks 76 (2015), 75–89. https://doi.org/10.1016/j.comnet.2014.11.001

    2015 doi

  7. [15]

    Zhitang Chen, Ke He, Jian Li, and Yanhui Geng. 2017. Seq2Img: A sequence-to- image based approach towards IP traffic classification using convolutional neural networks. In 2017 IEEE International Conference on Big Data, BigData 2017, Boston, MA, USA, December 11-14, 2017. 1271...

    2017 doi

  8. [16]

    Min Du, Feifei Li, Guineng Zheng, and Vivek Srikumar. 2017. DeepLog: Anomaly Detection and Diagnosis from System Logs through Deep Learning. InProceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, CCS 2017, Dallas, TX, USA, October 30 - Novembe...

    2017

  9. [17]

    Dyer, Scott E

    Kevin P. Dyer, Scott E. Coull, Thomas Ristenpart, and Thomas Shrimpton. 2012. Peek-a-Boo, I Still See You: Why Efficient Traffic Analysis Countermeasures Fail. In IEEE Symposium on Security and Privacy, SP 2012, 21-23 May 2012, San Francisco, California, USA. 332–346. https://...

    2012 doi

  10. [18]

    Chuck Fraleigh, Sue Moon, Bryan Lyles, Chase Cotton, Mujahid Khan, Deb Moll, Rob Rockell, Ted Seely, and S Christophe Diot. 2003. Packet-level traffic measurements from the Sprint IP backbone. IEEE network 17, 6 (2003), 6–16

    2003

  11. [19]

    Bryan Gleeson, Arthur Lin, Juha Heinänen, Grenville Armitage, and Andrew G. Malis. 2000. A Framework for IP Based Virtual Private Networks. RFC 2764 (2000), 1–62. https://doi.org/10.17487/RFC2764

    2000 doi

  12. [20]

    Ian Goodfellow, Yoshua Bengio, and Aaron Courville. 2016. Deep Learning. MIT Press. http://www.deeplearningbook.org

    2016

  13. [21]

    Alex Graves, Navdeep Jaitly, and Abdel rahman Mohamed. 2013. Hybrid speech recognition with Deep Bidirectional LSTM. 2013 IEEE Workshop on Automatic Speech Recognition and Understanding (2013), 273–278

    2013

  14. [22]

    Alex Graves and Jürgen Schmidhuber. 2005. Framewise phoneme classification with bidirectional LSTM and other neural network architectures.Neural networks : the official journal of the International Neural Network Society 18 5-6 (2005), 602– 10

    2005

  15. [23]

    Hoffman and Patrick McManus

    Paul E. Hoffman and Patrick McManus. 2018. DNS Queries over HTTPS (DoH). RFC 8484 (2018), 1–21. https://doi.org/10.17487/RFC8484

    2018 doi

  16. [24]

    Heidemann, Allison Mankin, Duane Wessels, and Paul E

    Zi Hu, Liang Zhu, John S. Heidemann, Allison Mankin, Duane Wessels, and Paul E. Hoffman. 2016. Specification for DNS over Transport Layer Security (TLS). RFC 7858 (2016), 1–19

    2016

  17. [25]

    Hong Huang, Hussein Al-Azzawi, and Hajar Brani. 2014. Network Traffic Anom- aly Detection. CoRR abs/1402.0856 (2014). arXiv:1402.0856 http://arxiv.org/abs/ 1402.0856

    2014 arXiv

  18. [26]

    Zhiheng Huang, Wei Xu, and Kai Yu. 2015. Bidirectional LSTM-CRF Models for Sequence Tagging. CoRR abs/1508.01991 (2015)

    2015 arXiv

  19. [27]

    Marc Liberatore and Brian Neil Levine. 2006. Inferring the source of encrypted HTTP connections. In Proceedings of the 13th ACM Conference on Computer and Communications Security, CCS 2006, Alexandria, V A, USA, Ioctober 30 - November 3, 2006. 255–263. https://doi.org/10.1145/...

    2006

  20. [28]

    Kale, Charles Elkan, and Randall C

    Zachary Chase Lipton, David C. Kale, Charles Elkan, and Randall C. Wetzel

  21. [29]

    Manuel López Martín, Belén Carro, Antonio Sánchez-Esguevillas, and Jaime Lloret. 2017. Network Traffic Classifier With Convolutional and Recurrent Neural Networks for Internet of Things. IEEE Access 5 (2017), 18042–18050. https://doi.org/10.1109/ACCESS.2017.2747560

    2017

  22. [30]

    Markus Miettinen, Samuel Marchal, Ibbad Hafeez, N Asokan, Ahmad-Reza Sadeghi, and Sasu Tarkoma. 2017. IoT Sentinel: Automated device-type identifi- cation for security enforcement in IoT. InDistributed Computing Systems (ICDCS), 2017 IEEE 37th International Conference on . IEE...

    2017

  23. [31]

    Tomas Mikolov, Kai Chen, Greg Corrado, and Jeffrey Dean. 2013. Efficient estimation of word representations in vector space.arXiv preprint arXiv:1301.3781 (2013)

    2013 arXiv

  24. [32]

    Yisroel Mirsky, Tomer Doitshman, Yuval Elovici, and Asaf Shabtai. 2018. Kitsune: An Ensemble of Autoencoders for Online Network Intrusion Detection. In 25th Annual Network and Distributed System Security Symposium, NDSS 2018, San Diego, California, USA, February 18-21, 2018 . ...

    2018

  25. [33]

    Andriy Panchenko, Fabian Lanze, Jan Pennekamp, Thomas Engel, Andreas Zinnen, Martin Henze, and Klaus Wehrle. 2016. Website Fingerprint- ing at Internet Scale. In 23rd Annual Network and Distributed System Se- curity Symposium, NDSS 2016, San Diego, California, USA, February 21-24,

    2016

  26. [34]

    Vera Rimmer, Davy Preuveneers, Marc Juarez, Tom van Goethem, and Wouter Joosen. 2018. Automated Website Fingerprinting through Deep Learning. In 25th Annual Network and Distributed System Security Symposium, NDSS 2018, San Diego, California, USA, February 18-21, 2018 . https:/...

    2018 arXiv

  27. [35]

    Sandra Siby, Rajib Ranjan Maiti, and Nils Ole Tippenhauer. 2017. IoTScan- ner: Detecting and Classifying Privacy Threats in IoT Neighborhoods. CoRR abs/1701.05007 (2017). arXiv:1701.05007 http://arxiv.org/abs/1701.05007

    2017 arXiv

  28. [36]

    Payap Sirinam, Mohsen Imani, Marc Juárez, and Matthew Wright. 2018. Deep Fin- gerprinting: Undermining Website Fingerprinting Defenses with Deep Learning. In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communi- cations Security, CCS 2018, Toronto, ON, Canada,...

    2018

  29. [37]

    Arunan Sivanathan, Daniel Sherratt, Hassan Habibi Gharakheili, Adam Radford, Chamith Wijenayake, Arun Vishwanath, and Vijay Sivaraman. 2017. Characteriz- ing and classifying IoT traffic in smart cities and campuses. In2017 IEEE Conference on Computer Communications Workshops, ...

    2017

  30. [38]

    http://wp.internetsociety.org/ndss/wp-content/uploads/sites/25/2017/09/ website-fingerprinting-internet-scale.pdf

    2017

  31. [39]

    Pyda Srisuresh and Matt Holdrege. 1999. IP Network Address Translator (NAT) Terminology and Considerations. RFC 2663 (1999), 1–30. https://doi.org/10. 17487/RFC2663

    1999

  32. [40]

    Simon, Yi-Min Wang, Wilf Russell, Venkata N

    Qixiang Sun, Daniel R. Simon, Yi-Min Wang, Wilf Russell, Venkata N. Padman- abhan, and Lili Qiu. 2002. Statistical Identification of Encrypted Web Browsing Traffic. In 2002 IEEE Symposium on Security and Privacy, Berkeley, California, USA, May 12-15, 2002. 19–30. https://doi.o...

    2002 arXiv

  33. [41]

    Ilya Sutskever, Oriol Vinyals, and Quoc V Le. 2014. Sequence to sequence learning with neural networks. InAdvances in neural information processing systems. 3104– 3112

    2014

  34. [42]

    Taylor, Riccardo Spolaor, Mauro Conti, and Ivan Martinovic

    Vincent F. Taylor, Riccardo Spolaor, Mauro Conti, and Ivan Martinovic. 2016. AppScanner: Automatic Fingerprinting of Smartphone Apps from Encrypted Network Traffic. In IEEE European Symposium on Security and Privacy, EuroS&P 2016, Saarbrücken, Germany, March 21-24, 2016 . 439–...

    2016

  35. [43]

    Stankovic, and Kamin Whitehouse

    Vijay Srinivasan, John A. Stankovic, and Kamin Whitehouse. 2008. Protecting your daily in-home activity information from a wireless snooping attack. In UbiComp 2008: Ubiquitous Computing, 10th International Conference, UbiComp 2008, Seoul, Korea, September 21-24, 2008, Proceed...

    2008

  36. [44]

    Nino Vincenzo Verde, Giuseppe Ateniese, Emanuele Gabrielli, Luigi Vincenzo Mancini, and Angelo Spognardi. 2014. No NAT’d User Left Behind: Fingerprint- ing Users behind NAT from NetFlow Records Alone. In IEEE 34th International Conference on Distributed Computing Systems, ICDC...

    2014 doi

  37. [45]

    Wright, Scott E

    Charles V. Wright, Scott E. Coull, and Fabian Monrose. 2009. Traffic Morphing: An Efficient Defense Against Statistical Traffic Analysis. InProceedings of the Network and Distributed System Security Symposium, NDSS 2009, San Diego, California, USA, 8th February - 11th February...

    2009

  38. [46]

    Jishen Yu, Feng Liu, Wenli Zhou, and Hua Yu. 2014. Hadoop-based network traffic anomaly detection in backbone. In IEEE 3rd International Conference on Cloud Computing and Intelligence Systems, CCIS 2014, Shenzhen, China, November 27-29, 2014. 140–145. https://doi.org/10.1109/C...

    2014

  39. [48]

    Luca Vassio, Danilo Giordano, Martino Trevisan, Marco Mellia, and Ana Paula Couto da Silva. 2017. Users’ Fingerprinting Techniques from TCP Traffic. In Proceedings of the Workshop on Big Data Analytics and Machine Learning for Data Communication Networks, Big-DAMA@SIGCOMM 2017...

    2017

  40. [2005]

    In Privacy Enhancing Technologies, 5th International Workshop, PET 2005, Cavtat, Croatia, May 30-June 1, 2005, Revised Selected Papers

    Privacy Vulnerabilities in Encrypted HTTP Streams. In Privacy Enhancing Technologies, 5th International Workshop, PET 2005, Cavtat, Croatia, May 30-June 1, 2005, Revised Selected Papers . 1–11. https://doi.org/10.1007/11767831_1

    2005 doi

  41. [2016]

    CoRR abs/1511.03677 (2016)

    Learning to Diagnose with LSTM Recurrent Neural Networks. CoRR abs/1511.03677 (2016)

    2016 arXiv

  42. [2017]

    https://doi.org/10.1109/CEC.2017.7969609

    2502–2509. https://doi.org/10.1109/CEC.2017.7969609

    2017

  43. [2018]

    Peek-a-Boo: I see your smart home activities, even encrypted! CoRR abs/1808.02741 (2018)

    2018 arXiv

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.