MAppPrint: Robust, real-time mobile app fingerprinting via traffic behavior correlation graphs

Under dynamic networks, real-time constraints, and an unknown number of concurrent apps, how to identify the mobile apps in use from encrypted traffic.

• Scenario and importance: The authors state that after communication encryption, adversaries can still sniff traffic at wireless access points, switches, and gateways, using side channels such as packet length and inter-arrival time to infer apps, monitor real-time behavior, or launch subsequent attacks targeting transactions or logins.
• Shortcomings of existing methods: Single-flow methods use only a single network flow, and the authors state their accuracy is unsatisfactory in practice. Multi-flow methods extract features from each flow independently and then aggregate at the flow level, obtaining only coarse-grained concurrency patterns; the authors state they are prone to drift under app updates, network jitter, or regional changes, and also struggle to distinguish functionally similar apps. Long observation windows lead to high identification latency, and most methods ignore throughput under high traffic and assume only one app at a time.
• Core observation: The authors believe that consecutive packets in the same direction with small inter-arrival times are the smallest units carrying complete networked activities, and local patterns are relatively stable; the responses and triggers between behaviors correspond to in-app operation logic and module dependencies, so they can serve as fingerprints.
• This paper's approach: Proposes MAppPrint. It uses the traffic behavior correlation graph TBCG to model unit behaviors and three correlations (sequential, trigger, concurrent), compresses redundant nodes and edges, and then performs unsupervised decomposition to uniformly identify single-app and multi-app traffic.
• Threat model:
  • Goal: Identify the apps in use from encrypted traffic to infer the target user's behavioral state or facilitate subsequent attacks.
  • Knowledge: Before the attack, collect target app samples in an offline environment and train the model. It cannot use packet payloads, nor destination metadata such as domain names or SNI; the authors state this information is usually encrypted. There is no prior on the number of concurrent apps.
  • Capability: Sniff at the mobile network edge. Deployment conditions include app updates, regional or network changes, network jitter, and real-time tracking under high-speed, high-traffic conditions. Traffic can be single-app or a mix of multiple apps on the same device.
  • Victim: Encrypted traffic between mobile devices and remote servers. The trained model is deployed on the target network to analyze traffic traces.

Single-flow application fingerprinting

• AppScanner (Taylor et al., EuroS&P 2016; TIFS 2018): represents each TCP flow with 54 packet-length statistical features and uses SVM to identify applications. The introduction labels early single-flow attacks as learning distinguishable patterns from a single flow, citing FS-Net (Liu et al., INFOCOM 2019).
• DappGraph (Shen et al., TIFS 2021) and GFGC (Karunanayake et al., TIFS 2024): represent each network flow as a packet interaction graph and use GNNs to identify applications.

Multi-flow application fingerprinting

• FlowPrint (van Ede et al., NDSS 2020) and MAppGraph (Pham et al., ACSAC 2021): represent concurrent flows as destination-related graphs, using graph matching or DGCNN respectively for identification.
• FG-Net (Jiang et al., Computer Networks 2022), FlowMiner (Xu et al., INFOCOM 2025), and Tan et al. (TIFS 2024): represent concurrent flows as flow interaction graphs and use GNNs. Table I writes this work as STC-WF, Related Work as STC-WC, both citing [20]. Table I also lists HA (Qu et al., USENIX Security 2023).
• The authors' criticism of this category is that single-flow methods fail to capture correlations between flows; existing multi-flow methods are fragile in dynamic environments, have limited timeliness, and cannot handle multiple applications, thus still unsuitable for real AF.

Website fingerprinting

• Handcrafted features include k-fingerprinting (Hayes and Danezis, USENIX Security 2016) and Panchenko et al. (NDSS 2016), combined with SVM or random forests, making lightweight website fingerprinting systems.
• Automated learning includes AWF (Rimmer et al., NDSS 2018), using CNNs, RNNs, or Transformers to learn fingerprints from raw traffic and identify websites.
• Multi-tab website fingerprinting (Yin et al., TDSC 2021; Deng et al., S&P 2023; Jin et al., CCS 2023) treats simultaneous visits to multiple websites as multi-label classification and assumes users open a preset number of websites. The authors say this assumption hinders direct use for real AF.

Baselines and datasets

• Baseline methods: 4 single-flow methods AppScanner, AWF, FS-Net, DappGraph, and 4 multi-flow methods FlowPrint, MappGraph, FG-Net, FlowMiner. Metrics are Precision and F1.
• Benchmarks/datasets: FOAP, MAPP, SIM-APP, SAMF, MAMF, SAMF-Drift, SAMF-Region, SAMF-Net, SAMF-Failure; X-Web, IoT-SENTINEL, and USTC-TFC are also used in discussion.

The authors distinguish this work from offline, aggregation-only multi-flow attacks: they use traffic behavior as the analysis unit and capture behavior-level dependencies, then use compression and decomposition to handle single and multiple applications. In contributions, the authors claim MAppPrint is the first AF method that simultaneously addresses accuracy, timeliness, and robustness, and that the released benchmark is the first AF benchmark for complex scenarios.

MAppPrint works in three steps: building the TBCG, compressing the graph, and identifying apps. The input is a traffic trace within an observation window, and the output is a single-app or multi-app label.

Unit Traffic Behavior

• A trace is a sequence of packets. Each packet has a five-tuple, byte length, direction, and timestamp; packets with the same five-tuple form a flow, and bidirectional flows contain both uplink and downlink.
• A unit traffic behavior is a sequence of consecutive packets in a bidirectional flow, in the same direction, with inter-arrival times not exceeding a threshold. Extraction is in Appendix Alg. 1. The default packet interval threshold δ is 600ms (Table XIII).
• Each behavior becomes a 12-dimensional vector: 6 transport features, 3 length features, and 3 time features (Appendix Table X). The authors state that these features ignore specific packet details to mitigate the impact of dynamic networks on fingerprint stability.

Three Correlations and Graph Construction

• Sequential correlation: same flow and temporally adjacent, with interval less than δ′. Default δ′ is 1s, representing request–response within a flow.
• Trigger correlation: different flows, non-overlapping durations, with interval less than δ″. Default δ″ is 2s. The authors use online payment triggering authentication, and payment only after authentication succeeds, to illustrate module dependencies.
• Concurrent correlation: different flows with overlapping durations, with edges in both directions. The authors use simultaneous requests for text, images, and video to illustrate cross-flow collaboration.
• TBCG is a directed acyclic graph, with nodes as behaviors and edges as any of the above correlations. Graph construction is in Appendix Alg. 2.

Graph Compression

• The authors use Facebook's 3,000 10-second traces to illustrate that uncompressed graphs are large: on average 164 nodes and 325 edges (Fig 3).
• Offline, K anchors are selected, and each node is compared only with anchors; if all are similar to the same anchor, they are merged. The authors state this avoids pairwise comparisons, and claim that K/|V| between 0.1 and 0.2 balances compression and accuracy. In Table XIII, K is the number of apps times 20.
• Behaviors with no more than 3 packets are short behaviors. Among 6,000 Facebook behaviors, the authors state short behaviors account for 91% but transmit only 32% of bytes. Short behaviors are selected by frequency for the top 0.9K, compared using full packet length sequences; long behaviors use PrefixSpan to select the top 0.1K frequent packet-length subsequences. Anchor mining is done before deployment.
• Similar nodes are merged into pseudo-nodes, features are averaged, original edges are inherited, and duplicate edges are removed.

Single-App Classification and Type Determination

• Each app has a one-vs-rest GNN: graph attention layer, mean pooling, and sigmoid output for acceptance probability. The authors state it can better reject multi-app traffic unseen during training than a multi-class classifier. L outputs are stacked and normalized into a distribution p, and each classifier is trained independently with cross-entropy (Appendix Alg. 3).
• The structure is a two-layer GAT, hidden size 128, 4 attention heads, dropout 0.1 (Table XII). Learning rate is 0.001, batch size 32 (Table XIII). Implementation is Python 3.8, TShark, and PyTorch, with five-fold cross-validation averaged.
• The authors state that p for single apps is often unimodal, while for multi-app it is flatter (Fig 5). Similarity is defined as s=1/(1+χ²(p,1(p))), i.e., how close p is to its one-point distribution. The threshold is θ=μ−3δ, where μ and δ are the mean and standard deviation of s over all labeled single-app traces. If s is not less than θ, the label is argmax; otherwise, it enters decomposition.

Multi-App Decomposition

• All trigger and concurrent edges are removed, so subgraphs retain only intra-flow sequential structure. The authors state each subgraph belongs to one app and characterizes flow-level interactions and transmissions. Subgraphs are made into 10-dimensional features (Appendix Table XI).
• DBSCAN clustering is used, with default maximum cluster radius 0.5 and minimum points 2. Subgraphs in the same cluster are merged back into a single-app TBCG according to the original graph's edges, then fed into the single-app classifier.
• The authors state this reduces multi-app identification to multiple single-app identifications, avoiding collecting extensive labels for app combinations. In the discussion, the authors state the system is designed to be deployed before NAT, so that flows from different devices can be separated in advance.

Experimental Setup

• Methods: MAppPrint; baselines are AppScanner, AWF, FS-Net, DappGraph, FlowPrint, MappGraph, FG-Net, FlowMiner.
• Data: FOAP takes the 120 apps with the longest collection time from 1,000 apps; MAPP is the top 101 from Google Play, triggered by real volunteer interactions; SIM-APP is 17 functionally similar online audio apps. SAMF removes banking and payment apps requiring authentication from the top 100 on Play, leaving 94. MAMF has concurrency 2–5. Dynamic sets are SAMF-Drift, SAMF-Region, SAMF-Net, SAMF-Failure. The authors state there are 12 datasets in total, over 450 GB.
• Protocol: For single apps, wt is 5s, 10s, 20s, 60s; for multi-app, robustness, and efficiency experiments, wt=30s. Five-fold cross-validation, reporting average Precision and F1. Also reports TPR, FNR, clustering accuracy, throughput, and prediction latency.
• Platform: Efficiency experiments replay SAMF on a laptop with i7-10875 CPU and RTX2060 GPU. The paper does not report the number of traces per dataset.

Main Results

The table below shows Precision (%) at wt=60s, based on Table III, IV. AppScanner, FS-Net, and FlowMiner are omitted; on FOAP, MAPP, SAMF, SIM-APP they are 92.4/93.8/82.9/84.9, 81.0/78.7/51.9/72.3, and 90.4/91.3/86.4/75.0, respectively.

Swipe horizontally to read the table

Method	FOAP	MAPP	SAMF	SIM-APP
MAppPrint	96.5	97.8	93.1	87.1
FG-Net	90.7	93.6	88.0	77.3
MappGraph	90.7	92.5	81.1	76.3
AWF	65.5	75.1	76.7	78.6
FlowPrint	66.2	81.0	63.8	60.9
DappGraph	66.8	78.7	50.7	72.2

• The authors claim improvements of 4.9–5.8% over MappGraph and FG-Net on FOAP, MAPP, and SAMF, and 6.9–7.6% on SIM-APP. In Table IV, SIM-APP, wt=60s, AppScanner's Precision is 84.9%, MAppPrint is 87.1%, and FG-Net is 77.3%.
• The authors state that on the three regular datasets, wt=20s is not lower than each baseline's wt=60s, with timeliness improvement exceeding 300%; the abstract writes 3–6 times, and states SIM-APP is six times. On FOAP, MAppPrint at wt=20s has Precision 91.5%, lower than AppScanner at wt=60s (92.4%). On SIM-APP, wt=10s is 78.7%, lower than AppScanner at wt=60s (84.9%); its F1 is 77.1%, while AppScanner at wt=60s has F1 69.4%.
• Exceptions: On MAPP, FS-Net's Precision at wt=5s is 80.1% and at wt=60s is 78.7%; on SAMF, DappGraph at wt=5s and 60s is 50.7%; on FOAP, FlowPrint at wt=5s is 11.2%.

Multi-App Identification

• Table VI, wt=30s: MAppPrint foreground Precision for Na=2 to 5 is 77.9%, 74.3%, 72.8%, 72.2%, and background from 75.1% to 69.3%. The authors claim it is 12.1–13.9% higher than the strongest baseline. In the same table, Na=5 foreground, AWF is 66.3% and FG-Net is 34.1%. The authors state that multi-flow baselines decline as Na increases, with AppScanner and AWF declining less; and state that foreground is usually higher because background cannot be directly interacted with.
• Table VII: Single-app TPR for Na=2 to 5 is 98.3%, 97.9%, 98.2%, 98.4%, multi-app TPR is 88.2%, 89.7%, 91.5%, 93.6%, and overall Precision is 92.1%, 93.4%, 95.7%, 95.9%. In Table VIII, MAppPrint clustering accuracy ranges from 73.4% to 67.8%, and AWF from 61.3% to 55.7%. The authors state that as Na increases, mixed patterns become more complex, clustering accuracy slightly decreases, but multi-app is also easier to distinguish from single-app fingerprints.

Dynamic Environments

• After training in the initial environment, parameters are frozen, wt=30s. SAMF-Drift tracks 94 apps over 120 days. The authors state that over 80.0% of apps have updated, and after 120 days MAppPrint's Precision remains above 65.0% (Fig 6). The text does not give other readings from that figure.
• Table IX: MAppPrint Precision for A⇒B, A⇒C, H⇒L, H⇒4G is 80.0%, 66.9%, 72.3%, 60.8%, and FG-Net is 72.8%, 58.1%, 64.3%, 52.2%. A is 50 km from B and over 1,000 km from C. H, L, and 4G are 30 MB/s wireless, 5 MB/s wireless, and 4G cellular, respectively.
• Failures include packet loss, reordering, retransmission, and flow loss, with rates 0–30%. The authors state that under 30% reordering or flow loss, Precision drops by 5%, and is less than other methods in the paper (Fig 7). The text does not give point-by-point readings for Fig 7.

Throughput and Latency

• Fig 8: With compression, average throughput is 10.54 GB/s; without compression, 0.42 GB/s; the authors claim about 25 times improvement. Average prediction latency is 0.68s, with construction 0.60s, compression 0.08s, and separation and identification at 4.1×10−3 s and 6.3×10−3 s. The abstract writes throughput as 10.5 GB/s. The authors state that at 30 MB/s, this laptop can eavesdrop on about 360 devices simultaneously.
• Table XV, latency 30s: Throughput is AWF 2.87, FS-Net 0.90, MappGraph 6.38, FG-Net 4.49, MAppPrint 10.54 GB/s; Precision is 76.4%, 54.2%, 80.9%, 86.8%, 93.0%. The authors claim throughput is at least 65.2% higher and accuracy at least 6.2% higher.
• Fig 9: Nodes reduced by 37.5–81.5%, edges by 31.0–61.3%, FLOPs by 38.4–81.8%, and memory by 38.1–85.1%. Fig 10: SIM-APP Precision drops by 0.9%, and the other three datasets increase by 0.2%, 1.5%, and 0.4%; the paper does not map these three increments to specific datasets. The authors state that when K/|V| is between 0.1 and 0.2, compression ratio is 40–80%, throughput improves 22–25 times, and Precision drops 0.2–0.9% (Fig 14).

Other Ablations and Analyses

• Table XX, wt=30s: Full TBCG Precision on MAPP/SIM-APP is 97.2%/84.8%; removing all edges gives 92.8%/77.8%; replacing with packet bursts gives 94.7%/82.4%.
• Table V: On app-specific traffic, MAppPrint is 89.8%; on *.facebook.com it is 69.5%, *.googleapis.com 79.4%, and *.doubleclick.net 76.4%.
• Table XVII: In-app activity Precision 72.4%, F1 72.0%. In Table XVIII, Telegram's ChannelBrowse and TextChat both have F1 98.5%, and Twitter's LiveView is 41.7%.
• Table XIX: Precision on X-Web, IoT-SENTINEL, USTC-TFC is 80.0%, 82.3%, 99.5%. On USTC-TFC, FG-Net is also 99.5%; on IoT-SENTINEL, MappGraph is 48.7%.
• Table XXI: Open-world (94 target apps plus 906 non-target from FOAP) Precision for Na=1, 3, 5 is 91.9%, 68.6%, 66.3%, and closed-world is 93.0%, 73.6%, 70.6%.
• Table XXII: Under simulated NAT, Nd=2, 4 gives 81.6%, 75.7%, and without NAT is 92.9%, 93.0%. The authors state that when the same app runs simultaneously on different devices, it cannot be correctly fingerprinted. Fig 16 compares packet padding, packet delay, and packet injection; the authors state packet injection works best; the text does not give percentages for that figure.

Limitations and Future Directions Noted by the Authors

The paper does not have a separate Limitations section. In the Discussion, two items are explicitly stated as future work.

• When separating multiple apps, ambiguous traffic arising from services shared across apps may be incorrectly clustered. The authors state that such misclustering, if not severe, does not necessarily lead to app identification errors, and they plan to study robustness under high-ambiguity traffic conditions (§VI).
• When the same app runs simultaneously on different devices behind NAT, the authors state it cannot be correctly fingerprinted, and they plan to study this issue in the future (§VI).

Experimental Coverage

• Single-app comparisons include MAppPrint and 8 baselines, with data from 120 apps in FOAP, 101 in MAPP, 17 in SIM-APP, and 94 in SAMF, with windows of 5s, 10s, 20s, and 60s, reporting average Precision and F1 via five-fold cross-validation (§V-A, §V-B, Table III, IV).
• Multi-app uses MAMF, with concurrency 2–5, window 30s, and distinguishes foreground and background; single/multi-app distinction is also grouped by mixing ratio cr (§V-C, Table VI–VIII, XIV).
• Robustness is evaluated on 120-day updates, three cities, 30 MB/s and 5 MB/s, WiFi and cellular, as well as packet loss, reordering, retransmission, and flow loss (failure rates 0–30%), with the model frozen and not retrained (§V-D, Table IX, Fig 6, 7).
• Efficiency is evaluated by replaying SAMF on a laptop with i7-10875 CPU and RTX2060 GPU (§V-E). §VI also reports in-app activities for 6 high-interaction apps, X-Web, IoT-SENTINEL, USTC-TFC, open-world (94 target apps plus 906 non-target apps), simulated NAT with Nd=1, 2, 4, and packet padding, packet delay, and packet injection.
• The paper does not report five-fold standard deviations or significance tests, does not report the number of traces per dataset, and does not report point-by-point readings for Fig 6, Fig 7, Fig 15, and Fig 16. The authors state that multi-tab website fingerprinting assumes the number of websites is preset, so they do not directly use it as an AF method (§VII).

MAppPrint identifies the apps in use from encrypted traffic at the mobile network edge, targeting dynamic networks, real-time tracking, and an unknown number of concurrent apps.

It treats consecutive packets in the same direction with short intervals as unit behaviors, connects them into TBCG using sequential, trigger, and concurrent correlations, and merges similar nodes based on anchors. Each app has a one-vs-rest GAT classifier; if the label distribution is close to unimodal, it outputs a single app; otherwise, it removes inter-flow edges and uses DBSCAN to split back into single-app graphs. The adversary cannot use payloads, domain names, or SNI, and does not know the number of concurrent apps.

• In Table III, IV, with wt=60s, Precision on FOAP, MAPP, SAMF, and SIM-APP is 96.5%, 97.8%, 93.1%, and 87.1%. The authors claim improvements of 4.9–5.8% over the strongest baseline, 6.9–7.6% on ambiguous sets, and 3–6 times timeliness. On SIM-APP, AppScanner at wt=60s is 84.9%.
• With MAMF, wt=30s, Na=5, foreground and background Precision are 72.2% and 69.3% (Table VI). Overall Precision for single/multi-app distinction ranges from 92.1% to 95.9% for Na=2 to 5 (Table VII).
• With frozen models, Precision for A⇒C and H⇒4G is 66.9% and 60.8% (Table IX). The authors claim it remains above 65.0% after 120 days, and drops by 5% with 30% reordering or flow loss.
• Replaying SAMF, average throughput is 10.54 GB/s and prediction latency is 0.68s (Fig 8); the abstract writes throughput as 10.5 GB/s. The authors claim compression brings about 25 times throughput.
• The authors conclude that behavior-level dependencies, combined with compression and unified identification, enable online fingerprinting in dynamic environments. The authors state that packet injection disrupts both local patterns and behavior correlations; after tunnels like VPN encapsulate multiple flows into a single re-encrypted flow, the original correlations are unobservable. The authors plan to study high-ambiguity traffic and the case of the same app running simultaneously on multiple devices behind NAT.