AppScanner: Automatic Fingerprinting of Smartphone Apps from Encrypted Network Traffic
Project description
AppScanner
This code was implemented as part of the NDSS FlowPrint [1] paper, it implements the Single Large Random Forest Classifier of AppScanner [2]. We ask people to cite both works when using the software for academic research papers.
Dependencies
This code is written in Python3 and depends on the following libraries:
- Numpy
- Pandas
- Scikit-learn
- Scapy
To install these use the following command
pip3 install -U scapy numpy pandas scikit-learn
Usage
The AppScanner implementation can be tested with the main.py
script. This script allows you to specify .pcap files to load. After loading, the script splits the data into training and testing data and evaluates the performance. See main.py --help
for more information.
API
It is also possible to directly use the AppScanner code as an API. There are two main classes which need to be understood.
preprocessor.py
for extracting features from.pcap
files.appscanner.py
for applying the AppScanner detection.
Preprocessor
The Preprocessor
object is used to extract data from .pcap
files and label them. To this end, it uses the process
function which requires a list of files and a list of labels. The list of files must be pathnames to pcap files. The list of labels must be labels corresponding to each file. The example below shows how the Preprocessor
can be used.
Example
from preprocessor import Preprocessor
# Create object
preprocessor = Preprocessor()
# Load from files
X, y = preprocessor.process(['<path_file_1>', ..., '<path_file_n>'],
['<label_1>' , ..., '<label_n>'])
AppScanner
The AppScanner
object is used to find known applications in network traffic. It can be fit
with X_train
and y_train
arrays obtained by the Preprocessor
. After it has been fit
, the AppScanner
is able to predict
unknown samples X_test
. The example below shows how AppScanner
can be used.
Example
from appscanner import AppScanner
# Create object
scanner = AppScanner()
# Fit scanner
scanner.fit(X_train, y_train)
# Predict labels of test data
y_pred = scanner.predict(X_test)
References
[1] van Ede, T., Bortolameotti, R., Continella, A., Ren, J., Dubois, D. J., Lindorfer, M., Choffnes, D., van Steen, M. & Peter, A. (2020, February). FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic. In 2020 NDSS. The Internet Society.
[2] Taylor, V. F., Spolaor, R., Conti, M., & Martinovic, I. (2016, March). Appscanner: Automatic fingerprinting of smartphone apps from encrypted network traffic. In 2016 IEEE European Symposium on Security and Privacy (EuroS&P) (pp. 439-454). IEEE.
Bibtex
@inproceedings{vanede2020flowprint,
title={{FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic}},
author={van Ede, Thijs and Bortolameotti, Riccardo and Continella, Andrea and Ren, Jingjing and Dubois, Daniel J. and Lindorfer, Martina and Choffness, David and van Steen, Maarten, and Peter, Andreas}
booktitle={NDSS},
year={2020},
organization={The Internet Society}
}
@inproceedings{taylor2016appscanner,
title={Appscanner: Automatic fingerprinting of smartphone apps from encrypted network traffic},
author={Taylor, Vincent F and Spolaor, Riccardo and Conti, Mauro and Martinovic, Ivan},
booktitle={2016 IEEE European Symposium on Security and Privacy (EuroS\&P)},
pages={439--454},
year={2016},
organization={IEEE}
}
Project details
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Hashes for appscanner-1.0.1-py3-none-any.whl
Algorithm | Hash digest | |
---|---|---|
SHA256 | 3d7a02982ca9e7667a1554e8ef76a9d2aa504da252816102e10c70a4fc906b17 |
|
MD5 | b9e809309732a63928d95a6d47966c08 |
|
BLAKE2b-256 | ca92772b543352bd7d29bb8db13ec74ebffe7bda3972cee273afa31b6e999fd7 |