Publications - Pervasive Computing Laboratory

Access control anotacionsemantica authentication Cloud computing coap compromise cryptography cynamon emadrid emrisco home network I-Shaper identity management inrisco inteligenciafuentesabiertas Internet of Things IoT IPTV magos Pervasive computing privacy Protocols Qursa raudo2 Security Smart Card trust Trust management Ubisec VANETs 
Show all
2024
 Campo-Vázquez, Celeste;  García-Rubio, Carlos;  Jimenez-Berenguel, Andrea;  Moure-Garrido, Marta;  Almenares-Mendoza, Florina;  Díaz-Sánchez, Daniel
Inferring mobile applications usage from DNS traffic Proceedings Article 
In: Ad Hoc Networks, Elsevier B.V., 2024.
Abstract | Links | BibTeX | Tags: compromise, dns traffic, I-Shaper, mobile applications identification, Qursa, user privacy
@inproceedings{campo012,

title = {Inferring mobile applications usage from DNS traffic},

author = {Celeste Campo-Vázquez and Carlos García-Rubio and Andrea Jimenez-Berenguel and Marta Moure-Garrido and Florina Almenares-Mendoza and Daniel Díaz-Sánchez },

url = {https://www.sciencedirect.com/science/article/pii/S1570870524002129#d1e710},

doi = {https://doi.org/10.1016/j.adhoc.2024.103601},

year  = {2024},

date = {2024-07-19},

urldate = {2024-07-19},

booktitle = {Ad Hoc Networks},

publisher = {Elsevier B.V.},

abstract = {In the digital era, our lives are intrinsically linked to the daily use of mobile applications. As a consequence, we generate and transmit a large amount of personal data that puts our privacy in danger. Despite having encrypted communications, the DNS traffic is usually not encrypted, and it is possible to extract valuable information from the traffic generated by mobile applications. This study focuses on the analysis of the DNS traffic behavior found in mobile application traces, developing a methodology capable of identifying mobile applications based on the domains they query. With this methodology, we were able to identify apps with 98% accuracy. Furthermore, we have validated the effectiveness of the characterization obtained with one dataset by identifying traces from other independent datasets. The evaluation showed that the methodology provides successful results in identifying mobile applications.},

keywords = {compromise, dns traffic, I-Shaper, mobile applications identification, Qursa, user privacy},

pubstate = {published},

tppubtype = {inproceedings}

}

Close
In the digital era, our lives are intrinsically linked to the daily use of mobile applications. As a consequence, we generate and transmit a large amount of personal data that puts our privacy in danger. Despite having encrypted communications, the DNS traffic is usually not encrypted, and it is possible to extract valuable information from the traffic generated by mobile applications. This study focuses on the analysis of the DNS traffic behavior found in mobile application traces, developing a methodology capable of identifying mobile applications based on the domains they query. With this methodology, we were able to identify apps with 98% accuracy. Furthermore, we have validated the effectiveness of the characterization obtained with one dataset by identifying traces from other independent datasets. The evaluation showed that the methodology provides successful results in identifying mobile applications.
Close
https://www.sciencedirect.com/science/article/pii/S1570870524002129#d1e710
doi:https://doi.org/10.1016/j.adhoc.2024.103601
Close
2023
 Jimenez-Berenguel, Andrea;  Moure-Garrido, Marta;  Campo-Vázquez, Carlos García-Rubio Celeste
Characterizing Mobile Applications Through Analysis of DNS Traffic Conference 
PE-WASUN '23: Proceedings of the Int'l ACM Symposium on Performance Evaluation of Wireless Ad Hoc, Sensor & Ubiquitous Networks., ACM, 2023, ISBN: N 979-8-4007-0370-6.
Abstract | Links | BibTeX | Tags: android apps, compromise, dns traffic, encrypted dns, mobile apps characterization, Qursa, user privacy
@conference{campo013,

title = {Characterizing Mobile Applications Through Analysis of DNS Traffic},

author = {Andrea Jimenez-Berenguel and Marta Moure-Garrido and Carlos García-Rubio Celeste Campo-Vázquez},

doi = {https://doi.org/10.1145/3616394.3618268},

isbn = {N 979-8-4007-0370-6},

year  = {2023},

date = {2023-10-30},

urldate = {2023-10-30},

booktitle = {PE-WASUN '23: Proceedings of the Int'l ACM Symposium on Performance Evaluation of Wireless Ad Hoc, Sensor & Ubiquitous Networks.},

pages = {69-76},

publisher = {ACM},

abstract = {User privacy may remain vulnerable when using encrypted communication protocols, such as HTTPS, if DNS queries are sent in cleartext over UDP port 53 (Do53). In this study, we demonstrate the possibility of characterizing the mobile application a user is using based on its Do53 traffic. By analyzing a dataset of traffic captured from 80 Android mobile apps, we can identify the app being used based on its DNS queries with an accuracy of 88.75%. While modern operating systems, including Android since version 9.0, support encrypted DNS traffic, this feature is not enabled by default and relies on the DNS provider's support. Moreover, even when DNS traffic is encrypted, the DNS service provider still has access to our queries and could potentially extract information from them.},

keywords = {android apps, compromise, dns traffic, encrypted dns, mobile apps characterization, Qursa, user privacy},

pubstate = {published},

tppubtype = {conference}

}

Close
User privacy may remain vulnerable when using encrypted communication protocols, such as HTTPS, if DNS queries are sent in cleartext over UDP port 53 (Do53). In this study, we demonstrate the possibility of characterizing the mobile application a user is using based on its Do53 traffic. By analyzing a dataset of traffic captured from 80 Android mobile apps, we can identify the app being used based on its DNS queries with an accuracy of 88.75%. While modern operating systems, including Android since version 9.0, support encrypted DNS traffic, this feature is not enabled by default and relies on the DNS provider's support. Moreover, even when DNS traffic is encrypted, the DNS service provider still has access to our queries and could potentially extract information from them.
Close
doi:https://doi.org/10.1145/3616394.3618268
Close