Skip to main content

AppScanner: Automatic Fingerprinting of Smartphone Apps from Encrypted Network Traffic

Project description


This code was implemented as part of the NDSS FlowPrint [1] paper, it implements the Single Large Random Forest Classifier of AppScanner [2]. We ask people to cite both works when using the software for academic research papers.


This code is written in Python3 and depends on the following libraries:

  • Numpy
  • Pandas
  • Scikit-learn
  • Scapy

To install these use the following command

pip3 install -U scapy numpy pandas scikit-learn


The AppScanner implementation can be tested with the script. This script allows you to specify .pcap files to load. After loading, the script splits the data into training and testing data and evaluates the performance. See --help for more information.


It is also possible to directly use the AppScanner code as an API. There are two main classes which need to be understood.

  • for extracting features from .pcap files.
  • for applying the AppScanner detection.


The Preprocessor object is used to extract data from .pcap files and label them. To this end, it uses the process function which requires a list of files and a list of labels. The list of files must be pathnames to pcap files. The list of labels must be labels corresponding to each file. The example below shows how the Preprocessor can be used.

from preprocessor import Preprocessor

# Create object
preprocessor = Preprocessor()
# Load from files
X, y = preprocessor.process(['<path_file_1>', ..., '<path_file_n>'],
                            ['<label_1>'    , ..., '<label_n>'])


The AppScanner object is used to find known applications in network traffic. It can be fit with X_train and y_train arrays obtained by the Preprocessor. After it has been fit, the AppScanner is able to predict unknown samples X_test. The example below shows how AppScanner can be used.

from appscanner import AppScanner

# Create object
scanner = AppScanner()

# Fit scanner, y_train)
# Predict labels of test data
y_pred = scanner.predict(X_test)


[1] van Ede, T., Bortolameotti, R., Continella, A., Ren, J., Dubois, D. J., Lindorfer, M., Choffnes, D., van Steen, M. & Peter, A. (2020, February). FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic. In 2020 NDSS. The Internet Society.

[2] Taylor, V. F., Spolaor, R., Conti, M., & Martinovic, I. (2016, March). Appscanner: Automatic fingerprinting of smartphone apps from encrypted network traffic. In 2016 IEEE European Symposium on Security and Privacy (EuroS&P) (pp. 439-454). IEEE.


  title={{FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic}},
  author={van Ede, Thijs and Bortolameotti, Riccardo and Continella, Andrea and Ren, Jingjing and Dubois, Daniel J. and Lindorfer, Martina and Choffness, David and van Steen, Maarten, and Peter, Andreas}
  organization={The Internet Society}
  title={Appscanner: Automatic fingerprinting of smartphone apps from encrypted network traffic},
  author={Taylor, Vincent F and Spolaor, Riccardo and Conti, Mauro and Martinovic, Ivan},
  booktitle={2016 IEEE European Symposium on Security and Privacy (EuroS\&P)},

Project details

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

appscanner-1.0.1.tar.gz (7.4 kB view hashes)

Uploaded Source

Built Distribution

appscanner-1.0.1-py3-none-any.whl (10.8 kB view hashes)

Uploaded Python 3

Supported by

AWS AWS Cloud computing and Security Sponsor Datadog Datadog Monitoring Fastly Fastly CDN Google Google Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Sentry Sentry Error logging StatusPage StatusPage Status page