User mobile app encrypted activity detection

Mobile users install different types of applications on their mobile devices based on their interests and needs and perform various activities on them (known as in-app activities). In this paper, we demonstrate that a passive eavesdropper can identify fine grained in-app activities by analysing encrypted network traffic information obtained by sniffing a Wireless Local Area Network (WLAN). Even though encryption protocols are used to provide security over Internet communications, side channel data is still leaked from encrypted traffic. We utilise this data (frame length, inter arrival time and direction) to identify the in-app activities. Further as a first study of its kind, we show that it is possible to identify in-app activities accurately by observing a very small subset of traffic, rather than observing the entire transaction of an activity as presented in existing literature. To reach these observations, we evaluated 51 in-app activities from three popular social networking apps and identified more than 85% of them correctly using the Bayes Net machine learning algorithm.