Eavesdropping Mobile Apps and Actions through Wireless Traffic in the Open World

TL;DR

The paper addresses the privacy risks of encrypted WiFi traffic by presenting MACPrint, a system that fingerprints mobile apps and in-app actions using MAC-layer metadata in open-world settings. It integrates traffic preprocessing, multi-level feature extraction, and a Temporal Convolutional Network (TCN) with an OpenMax open-set layer to handle unseen apps, supplemented by an Android Label Recorder for efficient training annotations. Empirical evaluation on approximately 125 hours of data across 40+ apps shows high performance: over $96\%$ accuracy in closed-world and over $86\%$ in open-world, with the OpenMax component improving open-world recognition substantially. The work highlights a concrete pathway for MAC-layer traffic analysis threats and motivates the development of privacy-preserving defenses against such passive fingerprinting attacks.

Abstract

While smartphones and WiFi networks are bringing many positive changes to people's lives, they are susceptible to traffic analysis attacks, which infer user's private information from encrypted traffic. Existing traffic analysis attacks mainly target TCP/IP layers or are limited to the closed-world assumption, where all possible apps and actions have been involved in the model training. To overcome these limitations, we propose MACPrint, a novel system that infers mobile apps and in-app actions based on WiFi MAC layer traffic in the open-world setting. MACPrint first extracts rich statistical and contextual features of encrypted wireless traffic. Then, we develop Label Recorder, an automatic traffic labeling app, to improve labeling accuracy in the training phase. Finally, TCN models with OpenMax functions are used to recognize mobile apps and actions in the open world accurately. To evaluate our system, we collect MAC layer traffic data over 125 hours from more than 40 apps. The experimental results show that MAC-Print can achieve an accuracy of over 96% for recognizing apps and actions in the closed-world setting, and obtains an accuracy of over 86% in the open-world setting.

Figures (7)

• Figure 1: Threat model.
• Figure 2: System overview.
• Figure 3: App classifier and action classifier.
• Figure 4: Performance of different classifiers.
• Figure 5: Confusion matrix of action classification on WeChat, NetEase CloudMusic, Tencent Video, and Weibo.