[论文解读] The Dark Side(-Channel) of Mobile Devices: A Survey on Network Traffic Analysis

Mauro Conti, Qian Qian Li+2 more|arXiv (Cornell University)|Aug 12, 2017

Internet Traffic Analysis and Secure E-voting参考文献 85被引用 92

一句话总结

对最先进移动网络流量分析的全面综述，将工作按目标、捕获点和目标平台进行分类，并讨论加密、数据集、对策及未来方向。

ABSTRACT

In recent years, mobile devices (e.g., smartphones and tablets) have met an increasing commercial success and have become a fundamental element of the everyday life for billions of people all around the world. Mobile devices are used not only for traditional communication activities (e.g., voice calls and messages) but also for more advanced tasks made possible by an enormous amount of multi-purpose applications (e.g., finance, gaming, and shopping). As a result, those devices generate a significant network traffic (a consistent part of the overall Internet traffic). For this reason, the research community has been investigating security and privacy issues that are related to the network traffic generated by mobile devices, which could be analyzed to obtain information useful for a variety of goals (ranging from device security and network optimization, to fine-grained user profiling). In this paper, we review the works that contributed to the state of the art of network traffic analysis targeting mobile devices. In particular, we present a systematic classification of the works in the literature according to three criteria: (i) the goal of the analysis; (ii) the point where the network traffic is captured; and (iii) the targeted mobile platforms. In this survey, we consider points of capturing such as Wi-Fi Access Points, software simulation, and inside real mobile devices or emulators. For the surveyed works, we review and compare analysis techniques, validation methods, and achieved results. We also discuss possible countermeasures, challenges and possible directions for future research on mobile traffic analysis and other emerging domains (e.g., Internet of Things). We believe our survey will be a reference work for researchers and practitioners in this research field.

研究动机与目标

• 对面向移动设备的流量分析工作在三个维度上进行系统分类：目标、捕获点和目标平台。
• 总结59篇工作（2010–2017）的方法、验证数据集和结果。
• 讨论对手机流量分析及物联网等相关领域的对策、挑战和未来方向。

提出的方法

• 将综述的工作按分析目标、捕获点和目标移动平台进行分类。
• 评估并比较分析技术、验证方法及在数据集和研究中的结果。
• 强调加密（SSL/TLS、IPsec）对分析的影响，并讨论潜在对策。
• 提供数据集的综合梳理，并讨论未来研究方向与挑战。

实验结果

研究问题

• RQ1 移动流量分析追求的主要目标是什么？在文献中各目标出现的频率如何？
• RQ2 移动流量通常在分析中在哪里被捕获？每个捕获点的权衡是什么？
• RQ3 哪些移动平台（Android、iOS、Windows Phone、Symbian）在流量分析研究中代表性最强？
• RQ4 加密如何影响流量分析方法的可行性？
• RQ5 对于移动流量分析的未来研究，有哪些有效的对策与开放挑战？

主要发现

• 流量特征分析是研究最广泛的目标，其次是应用识别和使用研究。
• 流量捕获通常发生在有线网络、设备、AP、模拟器和监视器等处，规模和约束各不相同。
• Android和iOS在平台关注度上占主导，对Windows Mobile/Phone和Symbian的研究较少。
• 加密（SSL/TLS、IPsec）影响了许多分析，一些方法对加密具有鲁棒性，另一些则受损。
• 移动流量的每用户体积通常低于住宅流量，主要为下行，大多数流是短流且加密；HTTP/HTTPS是主要的应用层协议。
• Android/iOS流量的很大一部分来自广告和跟踪服务；流媒体视频（YouTube、Netflix）在流量模式中占比较大。