  The apps installed on a smartphone can reveal much information about a user,
such as their medical conditions, sexual orientation, or religious beliefs.
Additionally, the presence or absence of particular apps on a smartphone can
inform an adversary who is intent on attacking the device. In this paper, we
show that a passive eavesdropper can feasibly identify smartphone apps by
fingerprinting the network traffic that they send. Although SSL/TLS hides the
payload of packets, side-channel data such as packet size and direction is
still leaked from encrypted connections. We use machine learning techniques to
identify smartphone apps from this side-channel data. In addition to merely
fingerprinting and identifying smartphone apps, we investigate how app
fingerprints change over time, across devices and across different versions of
apps. Additionally, we introduce strategies that enable our app classification
system to identify and mitigate the effect of ambiguous traffic, i.e., traffic
in common among apps such as advertisement traffic. We fully implemented a
framework to fingerprint apps and ran a thorough set of experiments to assess
its performance. We fingerprinted 110 of the most popular apps in the Google
Play Store and were able to identify them six months later with up to 96%
accuracy. Additionally, we show that app fingerprints persist to varying
extents across devices and app versions.
