{"id":"https://openalex.org/W2467159119","doi":"https://doi.org/10.1145/2939918.2939929","title":"Can Android Applications Be Identified Using Only TCP/IP Headers of Their Launch Time Traffic?","display_name":"Can Android Applications Be Identified Using Only TCP/IP Headers of Their Launch Time Traffic?","publication_year":2016,"publication_date":"2016-07-15","ids":{"openalex":"https://openalex.org/W2467159119","doi":"https://doi.org/10.1145/2939918.2939929","mag":"2467159119"},"language":"en","primary_location":{"id":"doi:10.1145/2939918.2939929","is_oa":true,"landing_page_url":"https://doi.org/10.1145/2939918.2939929","pdf_url":"http://dl.acm.org/ft_gateway.cfm?id=2939929&type=pdf","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 9th ACM Conference on Security & Privacy in Wireless and Mobile Networks","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"http://dl.acm.org/ft_gateway.cfm?id=2939929&type=pdf","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5068161618","display_name":"Hasan Faik Alan","orcid":null},"institutions":[{"id":"https://openalex.org/I114027177","display_name":"University of North Carolina at Chapel Hill","ror":"https://ror.org/0130frc33","country_code":"US","type":"education","lineage":["https://openalex.org/I114027177"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Hasan Faik Alan","raw_affiliation_strings":["The University of North Carolina at Chapel Hill, Chapel Hill, NC, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"The University of North Carolina at Chapel Hill, Chapel Hill, NC, USA","institution_ids":["https://openalex.org/I114027177"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5101422816","display_name":"Jasleen Kaur","orcid":"https://orcid.org/0000-0001-9250-8618"},"institutions":[{"id":"https://openalex.org/I114027177","display_name":"University of North Carolina at Chapel Hill","ror":"https://ror.org/0130frc33","country_code":"US","type":"education","lineage":["https://openalex.org/I114027177"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Jasleen Kaur","raw_affiliation_strings":["The University of North Carolina at Chapel Hill, Chapel Hill, NC, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"The University of North Carolina at Chapel Hill, Chapel Hill, NC, USA","institution_ids":["https://openalex.org/I114027177"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":15.4576,"has_fulltext":true,"cited_by_count":86,"citation_normalized_percentile":{"value":0.98953728,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":95,"max":100},"biblio":{"volume":null,"issue":null,"first_page":"61","last_page":"66"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9988999962806702,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.788973867893219},{"id":"https://openalex.org/keywords/android","display_name":"Android (operating system)","score":0.5936739444732666},{"id":"https://openalex.org/keywords/network-packet","display_name":"Network packet","score":0.576181948184967},{"id":"https://openalex.org/keywords/deep-packet-inspection","display_name":"Deep packet inspection","score":0.5141547322273254},{"id":"https://openalex.org/keywords/encryption","display_name":"Encryption","score":0.485650897026062},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.47051873803138733},{"id":"https://openalex.org/keywords/traffic-classification","display_name":"Traffic classification","score":0.4688397943973541},{"id":"https://openalex.org/keywords/vendor","display_name":"Vendor","score":0.46483397483825684},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.45569908618927},{"id":"https://openalex.org/keywords/web-traffic","display_name":"Web traffic","score":0.4213534891605377},{"id":"https://openalex.org/keywords/real-time-computing","display_name":"Real-time computing","score":0.3538077175617218},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.15505534410476685}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.788973867893219},{"id":"https://openalex.org/C557433098","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android (operating system)","level":2,"score":0.5936739444732666},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.576181948184967},{"id":"https://openalex.org/C204679922","wikidata":"https://www.wikidata.org/wiki/Q734252","display_name":"Deep packet inspection","level":3,"score":0.5141547322273254},{"id":"https://openalex.org/C148730421","wikidata":"https://www.wikidata.org/wiki/Q141090","display_name":"Encryption","level":2,"score":0.485650897026062},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.47051873803138733},{"id":"https://openalex.org/C169988225","wikidata":"https://www.wikidata.org/wiki/Q7832484","display_name":"Traffic classification","level":3,"score":0.4688397943973541},{"id":"https://openalex.org/C2777338717","wikidata":"https://www.wikidata.org/wiki/Q1762621","display_name":"Vendor","level":2,"score":0.46483397483825684},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.45569908618927},{"id":"https://openalex.org/C2777672014","wikidata":"https://www.wikidata.org/wiki/Q1172573","display_name":"Web traffic","level":3,"score":0.4213534891605377},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.3538077175617218},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.15505534410476685},{"id":"https://openalex.org/C162853370","wikidata":"https://www.wikidata.org/wiki/Q39809","display_name":"Marketing","level":1,"score":0.0},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/2939918.2939929","is_oa":true,"landing_page_url":"https://doi.org/10.1145/2939918.2939929","pdf_url":"http://dl.acm.org/ft_gateway.cfm?id=2939929&type=pdf","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 9th ACM Conference on Security & Privacy in Wireless and Mobile Networks","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/2939918.2939929","is_oa":true,"landing_page_url":"https://doi.org/10.1145/2939918.2939929","pdf_url":"http://dl.acm.org/ft_gateway.cfm?id=2939929&type=pdf","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 9th ACM Conference on Security & Privacy in Wireless and Mobile Networks","raw_type":"proceedings-article"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","score":0.4699999988079071,"display_name":"Peace, Justice and strong institutions"}],"awards":[{"id":"https://openalex.org/G5611684447","display_name":"NeTS: Small: Web Traffic Monitoring Using Anonymized TCP/IP Traces","funder_award_id":"1526268","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G7288691599","display_name":null,"funder_award_id":"CNS-1526268","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W2467159119.pdf","grobid_xml":"https://content.openalex.org/works/W2467159119.grobid-xml"},"referenced_works_count":20,"referenced_works":["https://openalex.org/W197026479","https://openalex.org/W337489262","https://openalex.org/W1496436819","https://openalex.org/W1916902331","https://openalex.org/W1971497680","https://openalex.org/W1994956399","https://openalex.org/W2002658930","https://openalex.org/W2003063963","https://openalex.org/W2005802709","https://openalex.org/W2021949962","https://openalex.org/W2048702750","https://openalex.org/W2077673877","https://openalex.org/W2108217512","https://openalex.org/W2120948237","https://openalex.org/W2135088779","https://openalex.org/W2168924027","https://openalex.org/W2169263368","https://openalex.org/W2295321789","https://openalex.org/W2399392249","https://openalex.org/W4231184172"],"related_works":["https://openalex.org/W2041550843","https://openalex.org/W2537489883","https://openalex.org/W3119500019","https://openalex.org/W2017644937","https://openalex.org/W1976515580","https://openalex.org/W2917586021","https://openalex.org/W3011161512","https://openalex.org/W2928278548","https://openalex.org/W1917343041","https://openalex.org/W4226172882"],"abstract_inverted_index":{"The":[0],"ability":[1],"to":[2,40,105],"identify":[3,106],"mobile":[4],"apps":[5,59,85,108,119,170],"in":[6,12,27,99],"network":[7,66,75],"traffic":[8,16,52,67,76],"has":[9],"significant":[10],"implications":[11,214],"many":[13],"domains,":[14],"including":[15],"management,":[17],"malware":[18],"detection,":[19],"and":[20,36,144,196],"maintaining":[21],"user":[22],"privacy.":[23],"App":[24],"identification":[25,103,180],"methods":[26,46,96,141],"the":[28,100,107,111,128,132,139,147,155,169,178,188,198,205,213],"literature":[29],"typically":[30],"use":[31,93],"deep":[32],"packet":[33,129],"inspection":[34],"(DPI)":[35],"analyze":[37],"HTTP":[38,51],"headers":[39],"extract":[41],"app":[42,79,179],"fingerprints.":[43],"However,":[44],"these":[45],"cannot":[47],"be":[48,61,121,172],"used":[49,97,166],"if":[50,187,204],"is":[53,165,208],"encrypted.":[54],"We":[55,72,91,113,211],"investigate":[56],"whether":[57],"Android":[58,89,118],"can":[60,120,171],"identified":[62,122,173],"from":[63,150,157],"their":[64],"launch-time":[65],"using":[68,127],"only":[69],"TCP/IP":[70],"headers.":[71],"first":[73,133],"capture":[74],"of":[77,131,215],"86,109":[78],"launches":[80],"by":[81,126,193],"repeatedly":[82],"running":[83],"1,595":[84],"on":[86,146],"4":[87],"distinct":[88],"devices.":[90],"then":[92],"supervised":[94],"learning":[95,140],"previously":[98],"web":[101],"page":[102],"literature,":[104],"that":[109],"generated":[110],"traffic.":[112],"find":[114],"that:":[115],"(i)":[116],"popular":[117],"with":[123,174],"88%":[124],"accuracy,":[125],"sizes":[130],"64":[134],"packets":[135],"they":[136],"generate,":[137],"when":[138,154],"are":[142,191],"trained":[143],"tested":[145],"data":[148,156,190],"collected":[149],"same":[151],"device;":[152],"(ii)":[153],"an":[158],"unseen":[159],"device":[160],"(but":[161],"similar":[162],"operating":[163,206],"system/vendor)":[164],"for":[167],"testing,":[168],"67%":[175],"accuracy;":[176],"(iii)":[177],"accuracy":[181,199],"does":[182,200],"not":[183],"drop":[184,201],"significantly":[185,203],"even":[186],"training":[189],"stale":[192],"several":[194],"days,":[195],"(iv)":[197],"quite":[202],"system/vendor":[207],"very":[209],"different.":[210],"discuss":[212],"our":[216],"findings":[217],"as":[218,220],"well":[219],"open":[221],"issues.":[222]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":7},{"year":2024,"cited_by_count":4},{"year":2023,"cited_by_count":12},{"year":2022,"cited_by_count":8},{"year":2021,"cited_by_count":10},{"year":2020,"cited_by_count":9},{"year":2019,"cited_by_count":15},{"year":2018,"cited_by_count":12},{"year":2017,"cited_by_count":8}],"updated_date":"2026-06-11T09:08:48.828518","created_date":"2025-10-10T00:00:00"}