Fingerprinting Web Pages and Smartphone Apps from Encrypted Network Traffic with WebScanner

Traffic encryption reduces the visibility of Internet Service Providers (ISPs) on the services consumed by their customers. This is particularly challenging for monitoring and analysis of web and apps traffic, which is highly complex and heterogeneous. Loading a web-page or app today requires tens of flows to download the various resources located in distributed cloud servers from different content providers. We introduce WebScanner, a web-page and app fingerprinting approach capable to identify all the traffic flows corresponding to individual web-page and app loading sessions within concurrent web pages traffic, enabling highly detailed, per web-page analysis in practical deployments. Different from the state of the art in web and app traffic fingerprinting, WebScanner automatically performs the parsing of all the (encrypted) traffic generated by a web visit and its isolation from concurrent traffic, instead of assuming that an external oracle system does so. WebScanner also implements a deep fingerprinting approach to detect user action-dependent traffic from apps, relying on simple machine learning models and strong input features as fingerprints. Extensive evaluation across a large measurement dataset of popular web pages and mobile apps confirms the outstanding performance of WebScanner, identifying the top-500 Alexa websites with precision and recall (P/R) above 95%, isolating their full contents with P/R above 80% for up to 15 concurrent web pages visited by the same device, and detecting specific action-dependent apps traffic with average P/R above 92%.