Despite the increasing popularity of mobile applications and the widespread adoption of encryption techniques, mobile devices are still susceptible to security and privacy risks. In this paper, we propose ActiveTracker, a new type of sniffing attack that can reveal the fine-grained trajectory of userâs mobile app usage from a sniffed encrypted Internet traffic stream. It firstly adopts a sliding window based approach to divide the encrypted traffic stream into a sequence of segments corresponding to different app activities. Then each traffic segment is represented by a normalized temporal-spacial traffic matrix and a traffic spectrum vector. Based on the normalized representation, a deep neural network (DNN) model which consists of an app filter and an activity classifier is developed to extract comprehensive features from the input and uncover the crucial app usage trajectory conducted by the user. By extensive experiments on real-world app usage traffic collected from volunteers and on our synthetic traffic data, we show that the proposed approach achieves up to 79.65% accuracy in recognizing app trajectory over encrypted traffic streams.

尽管移动应用程序越来越流行并且加密技术得到广泛采用，但是移动设备仍然容易受到安全和隐私风险的影响。在本文中，我们提出了ActiveTracker，这是一种新型的嗅探攻击，可以从嗅探到的加密Internet流量中揭示用户移动应用使用情况的细粒度轨迹。它首先采用基于滑动窗口的方法，将加密的业务流划分为与不同应用程序活动相对应的分段序列。然后，每个交通路段都由归一化的时空交通矩阵和交通频谱矢量表示。基于归一化表示，开发了由应用程序过滤器和活动分类器组成的深度神经网络（DNN）模型，以从输入中提取全面的功能并揭示用户进行的关键应用程序使用轨迹。通过对志愿者收集的现实应用使用流量和我们的综合流量数据进行的广泛实验，