  In this paper, we present a complete system for on-device passive monitoring,
collection, and analysis of fine grained, large-scale packet measurements from
mobile devices. First, we describe the design and implementation of AntMonitor
as a userspace mobile app based on a VPN-service but only on the device
(without the need to route through a remote VPN server) and using only the
minimum resources required. We evaluate our prototype and show that it
significantly outperforms prior state-of-the-art approaches: it achieves
throughput of over 90 Mbps downlink and 65 Mbps uplink, which is 2x and 8x
faster than mobile-only baselines and is 94% of the throughput without VPN,
while using 2-12x less energy. Second, we show that AntMonitor is uniquely
positioned to serve as a platform for passive on-device mobile network
monitoring and to enable a number of applications, including: (i) real-time
detection and prevention of private information leakage from the device to the
network; (ii) passive network performance monitoring; and (iii) application
classification and user profiling. We showcase preliminary results from a pilot
user study at a university campus.
