Magnifier: Detecting Network Access via Lightweight Traffic-based Fingerprints

TL;DR

Magnifier tackles the problem of detecting mobile-device network access without deploying endpoint monitoring software by passively analyzing gateway traffic. It builds device-specific fingerprints from domain features using Domain Name Forests (dnForest) and refines them with a two-stage distillation to emphasize proprietary patterns, enabling real-time matching at the gateway with a lightweight algorithm. The authors validate Magnifier on the NetCess2023 dataset (26 devices across 7 brands) and show strong performance for both initial and repetitive access, including multi-device scenarios, while maintaining low false alarms and efficient runtime. The work culminates in a public dataset release and a practical deployment blueprint, highlighting the approach’s universality, scalability, and applicability to BYOD environments in real networks.

Abstract

Network access detection plays a crucial role in global network management, enabling efficient network monitoring and topology measurement by identifying unauthorized network access and gathering detailed information about mobile devices. Existing methods for endpoint-based detection primarily rely on deploying monitoring software to recognize network connections. However, the challenges associated with developing and maintaining such systems have limited their universality and coverage in practical deployments, especially given the cost implications of covering a wide array of devices with heterogeneous operating systems. To tackle the issues, we propose Magnifier for mobile device network access detection that, for the first time, passively infers access patterns from backbone traffic at the gateway level. Magnifier's foundation is the creation of device-specific access patterns using the innovative Domain Name Forest (dnForest) fingerprints. We then employ a two-stage distillation algorithm to fine-tune the weights of individual Domain Name Trees (dnTree) within each dnForest, emphasizing the unique device fingerprints. With these meticulously crafted fingerprints, Magnifier efficiently infers network access from backbone traffic using a lightweight fingerprint matching algorithm. Our experimental results, conducted in real-world scenarios, demonstrate that Magnifier exhibits exceptional universality and coverage in both initial and repetitive network access detection in real-time. To facilitate further research, we have thoughtfully curated the NetCess2023 dataset, comprising network access data from 26 different models across 7 brands, covering the majority of mainstream mobile devices. We have also made both the Magnifier prototype and the NetCess2023 dataset publicly available\footnote{https://github.com/SecTeamPolaris/Magnifier}.

Figures (7)

• Figure 1: Two types of methods for network access detection.
• Figure 2: The framework of Magnifier.
• Figure 3: An example of major dnTree and background dnTrees constructed from a Vivo smart phone.
• Figure 4: Real-time network access detection of Magnifier.
• Figure 5: Traffic capturing in real-world scenarios of NetCess2023.