[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-118049-en":3,"doc-seo-118049-105":30,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":4,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":27,"seo_description":14,"update_tm":28,"read_time":29},118049,549758252649,"Ivy","https://ap-avatar.wpscdn.com/avatar/8000253669c5317157?_k=1778319167496531819",8,"Research & Report","Mobile App Fingerprinting through Automata Learning and Machine Learning","Application fingerprinting is essential in network management and security to deliver high Quality of Service (QoS) and mitigate suspicious activity. The approach learns automata from encrypted traffic by observing temporal order among destination-related flow features, then represents each application as a language-style fingerprint. Fingerprints are labeled using machine-learning classifiers within the ML-NetLang framework. Evaluation reports an average accuracy of 95% on Android and iOS, outperforming behavioral, correlation, and learning-based state-of-the-art methods.","Mobile App Fingerprinting through Automata Learning and Machine Learning  \nFatemeh Marzani∗ , Fatemeh Ghassemi∗ , Zeynab Sabahi-Kaviani∗ , Thijs van Ede†, and Maarten van Steen†  \n∗ University of Tehran,  \nEmail: {marzani.f76, fghassemi, [z.sabahi}@ut.ac.ir](z.sabahi}@ut.ac.ir)  \n†University of Twente,  \nEmail: {t.s.vanede, [m.r.vansteen}@utwente.nl](m.r.vansteen}@utwente.nl)  \nAbstract—Application fingerprinting is crucial in network management and security to provide the best Quality of Service (QoS). To generate fingerprints for applications, we use an automata learning algorithm to observe the temporal order among destination-related features of network traffic and create a language as a fingerprint. We label fingerprints through machine learning classifiers. We propose our approach in a framework called ML-NetLang for fingerprinting mobile applications from encrypted network traffic. Our evaluation achievesan average accuracy of 95% for Android and iOS applications. ML-NetLang outperforms comparable state-of-the-art techniques using behavioral-based, correlation-based, and machine-learning solutions.  \nIndex Terms—Fingerprinting, Traffic Classification, Automata Learning, Machine Learning  \nI. INTRODUCTION Identifying active applications on a (desktop or mobile)  \ndevice is currently a central topic in computer science [1] . It is essential in network management, security, and intrusion detection to provide high Quality of Service (QoS) and prevent unusual behavior [2] . Several methods exist to identify active applications without installing intrusive monitoring agents on each device that observes network traffic. Traditional approaches are mainly based on port-based classification [3] and payload-based classification [4] . They are inefficient because of the wide usage of dynamic port assignment and encrypted traffic, respectively. Researchers apply machine learning, correlation-based, and behavioral classification to tackle these limitations. Machine Learning (ML) classification methods rely on statistical features of traffic on either a packetlevel [5] or flow-level [6]. ML methods generally use too many redundant features [2] . Correlation-based classification methods focus on finding the correlation between flows. Although correlation-based methods avoid feature redundancy as observed in ML approaches, they have high computational complexity [2] . FLOWPRINT [7] is a correlation-based tool that finds temporal correlations among destination-related features and extracts maximal cliques from these correlations, using them as application fingerprints. Behavioral methods [8, 9] observe behavioral aspects in the traffic (such as IP address, used protocol, and port number) to identify active applications.  \nAlthough behavioral methods are robust against encryption, their classification results are unsatisfactory [2] . We propose an ISBN 978-3-903176-57-7© 2023 IFIP  \napproach combining the behavioral method based on automata learning and machine learning.  \nOur approach leverages the framework of NetLang [10] to generate and classify automata models of applications based on the destination features of network flows. Netlang uses automata learning techniques to derive behavioral models of each application’s network traffic as k-Testable languages in the Strict Sense (k-TSS) [11] . K-TSS are a class of regular languages characterized by the sets of all prefixes and suffixes of length k − 1 and substrings of length k appearing in the words of the language. It models applications as a formal language, where traffic traces produced by the application are interpreted as words whose letters consist of individual traffic flows. Using these observed words, it derives the formal language, which, in turn, is used to identify applications. In other words, it transforms the application identification problem by classifying traffic traces into an application based on a distance function between the application’s language and the languag","cbCaic9mc6BV9Irr","https://ap.wps.com/l/cbCaic9mc6BV9Irr","pdf",1468733,1,9,"English","en",105,"# Abstract\n# Introduction\n## Motivation and Problem Context\n## Limitations of Existing Methods\n## Proposed Approach with Automata Learning and ML-NetLang\n## NetLang Background and Model Transformation\n## Alphabet Extraction and Classifier Redesign\n# Evaluation Summary","[{\"question\":\"How does ML-NetLang generate fingerprints for mobile applications from encrypted traffic?\",\"answer\":\"It applies automata learning to destination-related flow features, capturing the temporal order as a language-style fingerprint. Each trace is treated as a word whose symbols come from learned flow-based alphabets.\"},{\"question\":\"What are the main limitations of port-based and payload-based classification methods?\",\"answer\":\"Port-based classification is weakened by dynamic port assignment, while payload-based classification is ineffective under encrypted traffic. These conditions reduce identification reliability.\"},{\"question\":\"What performance results does the document report for Android and iOS?\",\"answer\":\"The evaluation achieves an average accuracy of about 95% for Android and iOS applications, improving on comparable state-of-the-art behavioral, correlation-based, and machine-learning techniques.\"}]","Mobile App Fingerprinting through Automata Learning and Machine Learning | PDF",1785681019,23,{"code":4,"msg":31,"data":32},"ok",{"site_id":24,"language":23,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":28},"mobile-app-fingerprinting-through-automata-learning-and-machine-learning","",{"@graph":36,"@context":85},[37,54,68],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,48,51],{"item":41,"name":42,"@type":43,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":47},"https://docshare.wps.com/document/","Document",2,{"item":49,"name":12,"@type":43,"position":50},"https://docshare.wps.com/document/research-report/",3,{"item":52,"name":13,"@type":43,"position":53},"https://docshare.wps.com/document/mobile-app-fingerprinting-through-automata-learning-and-machine-learning/118049/",4,{"url":52,"name":13,"@type":55,"author":56,"headline":13,"publisher":58,"fileFormat":61,"inLanguage":23,"description":14,"dateModified":62,"datePublished":62,"encodingFormat":61,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":57},"Person",{"url":41,"name":59,"@type":60},"DocShare","Organization","application/pdf","2026-08-02",true,{"@type":65,"interactionType":66,"userInteractionCount":4},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"How does ML-NetLang generate fingerprints for mobile applications from encrypted traffic?","Question",{"text":75,"@type":76},"It applies automata learning to destination-related flow features, capturing the temporal order as a language-style fingerprint. Each trace is treated as a word whose symbols come from learned flow-based alphabets.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"What are the main limitations of port-based and payload-based classification methods?",{"text":80,"@type":76},"Port-based classification is weakened by dynamic port assignment, while payload-based classification is ineffective under encrypted traffic. These conditions reduce identification reliability.",{"name":82,"@type":73,"acceptedAnswer":83},"What performance results does the document report for Android and iOS?",{"text":84,"@type":76},"The evaluation achieves an average accuracy of about 95% for Android and iOS applications, improving on comparable state-of-the-art behavioral, correlation-based, and machine-learning techniques.","https://schema.org",{"og:url":52,"og:type":87,"og:title":13,"og:site_name":59,"og:description":14},"article",{"robots":89,"canonical":52},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,120,123,127,130,134],{"id":20,"doc_module":4,"doc_module_name":46,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":47,"doc_module":4,"doc_module_name":46,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":53,"doc_module":4,"doc_module_name":46,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":46,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":46,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":46,"category_name":117,"show_sort_weight":118,"slug":119},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":121,"slug":122},30,"research-report",{"id":21,"doc_module":4,"doc_module_name":46,"category_name":124,"show_sort_weight":125,"slug":126},"Religion & Spirituality",20,"religion-spirituality",{"id":125,"doc_module":4,"doc_module_name":46,"category_name":128,"show_sort_weight":125,"slug":129},"World Cup","world-cup",{"id":131,"doc_module":4,"doc_module_name":46,"category_name":132,"show_sort_weight":131,"slug":133},10,"Lifestyle","lifestyle",{"id":135,"doc_module":4,"doc_module_name":46,"category_name":136,"show_sort_weight":106,"slug":137},19,"General","general"]