Can 't you hear me knocking：通过流量分析识别Android应用上的用户操作
Can't you hear me knocking: Identification of user actions on Android apps via traffic analysis
摘要：
随着智能手机的使用变得越来越普遍，人们也开始询问这种设备在多大程度上可以被恶意利用为“跟踪设备”。所关注的不仅是对手对设备进行物理或远程控制（例如，通过恶意应用程序），而且还与被动对手（没有上述能力）可以从设备通信中观察到的内容有关。后一个方向的工作旨在推断用户在其设备上安装的应用程序，或识别网络中特定用户的存在。在本文中，我们向前迈进了一步：我们调查在何种程度上是可行的，以确定用户在他的移动终端上做的具体行动，通过简单地窃听设备的网络流量。特别是，我们的目标是识别诸如在社交网络上浏览某人的个人资料，在朋友的墙上发布消息或发送电子邮件等行为。我们设计了一个系统，从加密的TCP/IP数据包开始实现这一目标：它通过识别网络流和应用机器学习技术来工作。我们做了一个完整的实现这个系统，并运行了一套完整的实验，这表明，它可以实现的准确性和精度高于95%，对于大多数考虑的行动。
英文摘要：
While smartphone usage become more and more pervasive, people start also asking to which extent such devices can be maliciously exploited as "tracking devices". The concern is not only related to an adversary taking physical or remote control of the device (e.g., via a malicious app), but also to what a passive adversary (without the above capabilities) can observe from the device communications. Work in this latter direction aimed, for example, at inferring the apps a user has installed on his device, or identifying the presence of a specific user within a network. In this paper, we move a step forward: we investigate to which extent it is feasible to identify the specific actions that a user is doing on his mobile device, by simply eavesdropping the device's network traffic. In particular, we aim at identifying actions like browsing someone's profile on a social network, posting a message on a friend's wall, or sending an email. We design a system that achieves this goal starting from encrypted TCP/IP packets: it works through identification of network flows and application of machine learning techniques. We did a complete implementation of this system and run a thorough set of experiments, which show that it can achieve accuracy and precision higher than 95%, for most of the considered actions.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
