Modern app traffic is almost universally encrypted (TLS/QUIC), so the payload itself reveals nothing to a passive observer. But metadata — packet sizes, timing, direction, burst structure — survives encryption untouched, and this metadata may leak surprising amounts of information about what’s actually happening on the device. In this project you will build, train, and evaluate a small machine learning model that recovers some of that information, and to reason about what it implies for user privacy.
App behaviours to target
Some possible examples:
- App/website identity — “which of these N apps is running”.
- In-app activity/action — not just which app, but what the user is doing in it: e.g. scrolling a feed vs. loading a video vs. sending a message vs. making a voice/video call within the same app.
- Keystroke-level timing in interactive apps — for chat-like apps sending one packet per keystroke, inter-packet timing can leak information about typing patterns.
Data collection
- For a small set of apps, you’ll capture traffic on a controlled test device (I’ll provide a rooted Android phone) using tcpdump and mitmproxy. Capture packet size, timestamp, direction (and also decrypted payload as ground truth for training), segment captures into fixed-length flows to use as model’s input e.g. 30-second windows of a few hundred packets.
Choose Model Architecture & Train
- We’ll focus on small sequence models e.g. a 1D CNN, LSTM or small transformer. I’ll provide access to a server with a GPU that can be used for training.
Evaluation
- As well as classification accuracy, the evaluation will explore the impact of defences such as padding (round packet sizes to fixed buckets), timing jitter, or routing through a VPN/Tor-like overlay.
- Baseline comparison: hand-engineered features (mean/variance of packet size, burst counts, etc.) + simple classifier vs. learned sequence model, to see whether the extra model complexity actually buys anything.