Ant Monitor A System for Monitoring from Mobile

Ant. Monitor: A System for Monitoring from Mobile Devices Anh Le, Janus Varmarken, Simon Langhoff, Anastasia Shuba, Minas Gjoka, Athina Markopoulou UC Irvine & IT Univ. Copenhagen

Mobile Traffic Growth Mobile Data Traffic Growth (Exabytes) 2014 – 2019 10 x growth 24, 3 16, 1 10, 7 6, 8 2, 5 2014 4, 2 2015 2016 2017 2018 Cisco VNI Mobile Forecast 2014— 2019 2

Mobile Traffic in Context com. Score Mobile Report 2014 3

Monitoring and Analyzing Mobile Traffic ISP Traces [Xu, IMC’ 11] [Chen, IMC’ 12] … Ant. Monitor Scale User Traces [Falaki, IMC’ 10] [Rodriguez, IMC’ 13] … Granularity of Information 4

Objectives of Ant. Monitor Designed for Crowdsourcing § Large-Scale Measurements • High compatibility § Fine-Grained Information • Full packet trace • Flexible annotation § Attractive to Users • Ease of use • High performance • Privacy control and protection 5

Outline 1. Introduction & Motivation 2. VPN Approaches 3. System Design and Implementation 4. Performance Evaluation 5. Example Applications 6

VPN-Based Approaches Ant. Monitor Collect, Analyze Log Server Collect, Analyze Meddle t. Packet. Cpt. VPN Server Collect, Analyze Collect 7

Ant. Monitor System 8

Traffic Interception & Routing 9

Traffic Interception & Routing 10

Traffic Interception & Routing 11

Traffic Interception & Routing 12

Ant. Client § Compatible with 95%+ Android today § Fine control of contributing apps § Real-time privacy leaks prevention § Log packets in PCAP-Next-Generation 13

Ant. Client: App Selection 14

Ant. Server § Support client’s dynamic IP • Session continuity § High-performance • Java: Netty asynchronous network I/O • C++: critical components § Cloud deployment ready • Pilot deployment on AWS 15

Log. Server § Log files automatically parsed and inserted into a database § Global analysis § Example applications • Network measurements • App classification • Privacy leaks detection 16

Performance Evaluation Typical Day 16 % r ito on An t. M VP N Battery Usage 13 % No Stress Test: Download 1 GB on Wi-Fi and 100 MB on Cellular 17

Application 1: Network Measurements § Feb 5 – Mar 15, 2015: 9 volunteers § 1. 5 GB cellular, 16 GB Wi-Fi § 95% HTTP/HTTPS Top apps 18

Application 2: App Classification of network flows to apps: • • • Fined-grained contextual information: ground truth F 1 -score up to 70. 1% using only network (layer 3) features Previous work: precision of 64. 1% using payload (host + user agent) 15 Top 30 Feature Categories 10 5 0 Payload Length Packet Length Interarrival Burstiness Time 19

Application 3: Privacy Leak Detection Personally Identifiable Information # Leaking Apps # Users IMEI 5 4 Android Device ID 4 6 Phone Number 1 1 Email Address 1 1 Location 1 2 20

Ongoing Work § Further improve performance, scaling, and user privacy • Replacing VPN Server with Client-Side Connection Translation Module § Enhance real-time privacy protection § Get more users, Google Play release 21

Ant. Monitor Summary § Design for Crowdsourcing • Large-scale measurements • Fine-grained information • Attractive to users § Applications • Network monitoring • Application classification • Privacy leak prevention • … http: //antmonitor. calit 2. uci. edu 22

http: //antmonitor. calit 2. uci. edu

Ant. Monitor 2. 0 Collect, Analyze Log Server Collect, Analyze VPN Server VPN service with connection translation 24

Battery Evaluation: A Typical Day § 2014 Nielsen Survey: Averaging 58 minutes of app usage per day • 22 minutes of Search, Portal, and Social Apps (Facebook, Chrome) • 21 minutes of Entertainment (You. Tube) • 7 minutes of Communication (Gmail) • 5 minutes of Productivity (Google Keep) • 3 minutes of News (Reddit News) 25