{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,23]],"date-time":"2026-04-23T08:00:26Z","timestamp":1776931226494,"version":"3.51.2"},"publisher-location":"New York, NY, USA","reference-count":56,"publisher":"ACM","license":[{"start":{"date-parts":[[2026,11,18]],"date-time":"2026-11-18T00:00:00Z","timestamp":1794960000000},"content-version":"vor","delay-in-days":401,"URL":"http:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"NSF","award":["2237552"],"award-info":[{"award-number":["2237552"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2025,10,13]]},"DOI":"10.1145\/3733802.3764059","type":"proceedings-article","created":{"date-parts":[[2025,11,18]],"date-time":"2025-11-18T09:38:21Z","timestamp":1763458701000},"page":"208-222","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":1,"title":["CryptoFilter: Privacy-Preserving Traffic Analysis of Weak Transport Layer Encryption at Internet Gateways"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-4670-4578","authenticated-orcid":false,"given":"Benjamin","family":"Mixon-Baca","sequence":"first","affiliation":[{"name":"Arizona State University, Tempe, Arizona, USA and Breakpointing Bad, Albuquerque, New Mexico, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0616-4765","authenticated-orcid":false,"given":"Diwen","family":"Xue","sequence":"additional","affiliation":[{"name":"University of Michigan, Ann Arbor, Michigan, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2188-8267","authenticated-orcid":false,"given":"Roya","family":"Ensafi","sequence":"additional","affiliation":[{"name":"Computer Science and Engineering, University of Michigan, Ann Arbor, Michigan, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7864-2992","authenticated-orcid":false,"given":"Jedidiah R.","family":"Crandall","sequence":"additional","affiliation":[{"name":"Arizona State University, Tempe, Arizona, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2025,11,18]]},"reference":[{"key":"e_1_3_3_2_2_2","unstructured":"2016. Art.4 GDPR \u2013 Definitions - General Data Protection Regulation (GDPR) \u2014 gdpr-info.eu. online. https:\/\/gdpr-info.eu\/art-4-gdpr\/"},{"key":"e_1_3_3_2_3_2","unstructured":"Nader Ammari Gustaf Bj\u00f6rksten Peter Micek and Deji Olukotun. 2023. The Rise of Mobile Tracking Headers: How Telcos Around the World Are Threatening Your Privacy. online. https:\/\/www.accessnow.org\/wp-content\/uploads\/2023\/07\/AIBT-Report.pdf"},{"key":"e_1_3_3_2_4_2","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.findings-emnlp.790"},{"key":"e_1_3_3_2_5_2","doi-asserted-by":"publisher","DOI":"10.1109\/MALWARE.2015.7413693"},{"key":"e_1_3_3_2_6_2","doi-asserted-by":"crossref","unstructured":"David Blei Andrew Ng and Michael Jordan. 2001. Latent dirichlet allocation. Advances in neural information processing systems 14 (2001).","DOI":"10.7551\/mitpress\/1120.003.0082"},{"key":"e_1_3_3_2_7_2","doi-asserted-by":"publisher","DOI":"10.1145\/3134600.3134605"},{"key":"e_1_3_3_2_8_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICCNC.2019.8685654"},{"key":"e_1_3_3_2_9_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-37456-2_14"},{"key":"e_1_3_3_2_10_2","unstructured":"CNCERT\/CC. 2020. 2020 China Internet Network Security Report. online. https:\/\/www.cert.org.cn\/publish\/main\/upload\/File\/2020%20Annual%20Report.pdf"},{"key":"e_1_3_3_2_11_2","doi-asserted-by":"publisher","DOI":"10.1109\/INFCOM.2013.6566868"},{"key":"e_1_3_3_2_12_2","doi-asserted-by":"publisher","DOI":"10.1145\/3355369.3355571"},{"key":"e_1_3_3_2_13_2","first-page":"605","volume-title":"22nd USENIX Security Symposium (USENIX Security 13)","author":"Durumeric Zakir","year":"2013","unstructured":"Zakir Durumeric, Eric Wustrow, and J\u00a0Alex Halderman. 2013. { ZMap} : fast internet-wide scanning and its security applications. In 22nd USENIX Security Symposium (USENIX Security 13). 605\u2013620."},{"key":"e_1_3_3_2_14_2","unstructured":"Emanuele Faranda. [n. d.]. GitHub - emanuele-f\/PCAPdroid: No-root network monitor firewall and PCAP dumper for Android \u2014 github.com. online. https:\/\/github.com\/emanuele-f\/PCAPdroid"},{"key":"e_1_3_3_2_15_2","first-page":"1323","volume-title":"26th USENIX Security Symposium (USENIX Security 17)","author":"Felt Adrienne\u00a0Porter","year":"2017","unstructured":"Adrienne\u00a0Porter Felt, Richard Barnes, April King, Chris Palmer, Chris Bentzel, and Parisa Tabriz. 2017. Measuring HTTPS Adoption on the Web. In 26th USENIX Security Symposium (USENIX Security 17). USENIX Association, Vancouver, BC, 1323\u20131338. https:\/\/www.usenix.org\/conference\/usenixsecurity17\/technical-sessions\/presentation\/felt"},{"key":"e_1_3_3_2_16_2","doi-asserted-by":"crossref","unstructured":"Philippe Flajolet \u00c9ric Fusy Olivier Gandouet and Fr\u00e9d\u00e9ric Meunier. 2007. Hyperloglog: the analysis of a near-optimal cardinality estimation algorithm. Discrete mathematics & theoretical computer scienceProceedings (2007).","DOI":"10.46298\/dmtcs.3545"},{"key":"e_1_3_3_2_17_2","unstructured":"FTC. 2024. How \u201clocation location location\u201d can lead to \u201cenforcement enforcement enforcement\u201d \u2014 ftc.gov. online. https:\/\/www.ftc.gov\/business-guidance\/blog\/2024\/01\/how-location-location-location-can-lead-enforcement-enforcement-enforcement"},{"key":"e_1_3_3_2_18_2","unstructured":"FTC. 2024. P = NP? Not exactly but here are some research questions from the Office of Technology. \u2014 ftc.gov. online. https:\/\/www.ftc.gov\/policy\/advocacy-research\/tech-at-ftc\/2024\/05\/p-np-not-exactly-here-are-some-research-questions-office-technology"},{"key":"e_1_3_3_2_19_2","doi-asserted-by":"publisher","DOI":"10.1109\/SAHCN.2016.7732993"},{"key":"e_1_3_3_2_20_2","unstructured":"Robert Graham. 2013. GitHub - robertdavidgraham\/masscan: TCP port scanner spews SYN packets asynchronously scanning entire Internet in under 5 minutes. github.com. online. https:\/\/github.com\/robertdavidgraham\/masscan"},{"key":"e_1_3_3_2_21_2","doi-asserted-by":"crossref","unstructured":"Danny\u00a0Yuxing Huang Noah Apthorpe Frank Li Gunes Acar and Nick Feamster. 2020. Iot inspector: Crowdsourcing labeled network traffic from smart home devices at scale. Proceedings of the ACM on Interactive Mobile Wearable and Ubiquitous Technologies 4 2 (2020) 1\u201321.","DOI":"10.1145\/3397333"},{"key":"e_1_3_3_2_22_2","doi-asserted-by":"crossref","unstructured":"Sakshi Jain Mobin Javed and Vern Paxson. 2016. Towards Mining Latent Client Identifiers from Network Traffic. Proc. Priv. Enhancing Technol. 2016 2 (2016) 100\u2013114.","DOI":"10.1515\/popets-2016-0007"},{"key":"e_1_3_3_2_23_2","unstructured":"Ron\u00a0Deibert Jeffrey\u00a0Knockel Adam\u00a0Senft. 2016. WUP! There It Is: Privacy and Security Issues in QQ Browser - The Citizen Lab \u2014 citizenlab.ca. online. https:\/\/citizenlab.ca\/2016\/03\/privacy-security-issues-qq-browser\/"},{"key":"e_1_3_3_2_24_2","volume-title":"USENIX security symposium","author":"Kim Hyang-Ah","year":"2004","unstructured":"Hyang-Ah Kim and Brad Karp. 2004. Autograph: Toward Automated, Distributed Worm Signature Detection.. In USENIX security symposium , Vol.\u00a0286. San Diego, CA."},{"key":"e_1_3_3_2_25_2","volume-title":"\u201cPlease do not make it public\u201d: Vulnerabilities in Sogou Keyboard encryption expose keypresses to network eavesdropping","author":"Knockel Jeffrey","year":"2023","unstructured":"Jeffrey Knockel, Zo\u00eb Reichert, and Mona Wang. 2023. \u201cPlease do not make it public\u201d: Vulnerabilities in Sogou Keyboard encryption expose keypresses to network eavesdropping. Technical Report. https:\/\/citizenlab.ca\/2023\/08\/vulnerabilities-in-sogou-keyboard-encryption\/"},{"key":"e_1_3_3_2_26_2","volume-title":"\u201cPlease do not make it public\u201d: Vulnerabilities in Sogou Keyboard encryption expose keypresses to network eavesdropping.","author":"Knockel Jeffrey","year":"2023","unstructured":"Jeffrey Knockel, Zo\u00eb Reichert, and Mona Wang. 2023. \u201cPlease do not make it public\u201d: Vulnerabilities in Sogou Keyboard encryption expose keypresses to network eavesdropping. Technical Report. https:\/\/utoronto.scholaris.ca\/items\/ab81bbdd-3bd0-4aab-8558-bc5a95e6b967"},{"key":"e_1_3_3_2_27_2","volume-title":"The not-so-silent type: Vulnerabilities across keyboard apps reveal keystrokes to network eavesdroppers","author":"Knockel Jeffrey","year":"2024","unstructured":"Jeffrey Knockel, Zo\u00eb Reichert, and Mona Wang. 2024. The not-so-silent type: Vulnerabilities across keyboard apps reveal keystrokes to network eavesdroppers. Technical Report. https:\/\/citizenlab.ca\/2024\/04\/vulnerabilities-across-keyboard-apps-reveal-keystrokes-to-network-eavesdroppers\/"},{"key":"e_1_3_3_2_28_2","volume-title":"6th USENIX Workshop on Free and Open Communications on the Internet (FOCI 16)","author":"Knockel Jeffrey","year":"2016","unstructured":"Jeffrey Knockel, Adam Senft, and Ronald Deibert. 2016. Privacy and Security Issues in BAT Web Browsers. In 6th USENIX Workshop on Free and Open Communications on the Internet (FOCI 16). USENIX Association, Austin, TX. https:\/\/www.usenix.org\/conference\/foci16\/workshop-program\/presentation\/knockel"},{"key":"e_1_3_3_2_29_2","volume-title":"Chinese Keyboard App Vulnerabilities Explained","author":"Knockel Jeffrey","year":"2023","unstructured":"Jeffrey Knockel, Mona Wang, and Zo\u00eb Reichert. 2023. Chinese Keyboard App Vulnerabilities Explained. Technical Report. https:\/\/citizenlab.ca\/2024\/04\/chinese-keyboard-app-vulnerabilities-explained\/"},{"key":"e_1_3_3_2_30_2","unstructured":"Beau Kujath Jeffrey Knockel Paul Aguilar Diego Morabito Masashi Crete-Nishihata and Jedidiah\u00a0R Crandall. 2024. Analyzing Prominent Mobile Apps in Latin America. Free and Open Communications on the Internet (2024)."},{"key":"e_1_3_3_2_31_2","doi-asserted-by":"crossref","unstructured":"Thomas\u00a0K Landauer and Susan\u00a0T Dumais. 1997. A solution to Plato\u2019s problem: The latent semantic analysis theory of acquisition induction and representation of knowledge. Psychological review 104 2 (1997) 211.","DOI":"10.1037\/\/0033-295X.104.2.211"},{"key":"e_1_3_3_2_32_2","volume-title":"TikTok vs Douyin A Security and Privacy Analysis","author":"Lin Pellaeon","year":"2021","unstructured":"Pellaeon Lin. 2021. TikTok vs Douyin A Security and Privacy Analysis. Technical Report."},{"key":"e_1_3_3_2_33_2","volume-title":"5th USENIX Workshop on Free and Open Communications on the Internet (FOCI 15)","author":"Marczak Bill","year":"2015","unstructured":"Bill Marczak, Nicholas Weaver, Jakub Dalek, Roya Ensafi, David Fifield, Sarah McKune, Arn Rey, John Scott-Railton, Ron Deibert, and Vern Paxson. 2015. An Analysis of China\u2019s \u201cGreat Cannon\u201d. In 5th USENIX Workshop on Free and Open Communications on the Internet (FOCI 15). USENIX Association, Washington, D.C.https:\/\/www.usenix.org\/conference\/foci15\/workshop-program\/presentation\/marczak"},{"key":"e_1_3_3_2_34_2","doi-asserted-by":"crossref","unstructured":"Leland McInnes John Healy Nathaniel Saul and Lukas Grossberger. 2018. UMAP: Uniform Manifold Approximation and Projection. The Journal of Open Source Software 3 29 (2018) 861.","DOI":"10.21105\/joss.00861"},{"key":"e_1_3_3_2_35_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-15509-8_5"},{"key":"e_1_3_3_2_36_2","unstructured":"Jeffrey\u00a0Knockel Mona\u00a0Wang Pellaeon\u00a0Lin. 2024. Should We Chat Too? Security Analysis of WeChat\u2019s MMTLS Encryption Protocol - The Citizen Lab \u2014 citizenlab.ca. online. https:\/\/citizenlab.ca\/2024\/10\/should-we-chat-too-security-analysis-of-wechats-mmtls-encryption-protocol\/"},{"key":"e_1_3_3_2_37_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2005.15"},{"key":"e_1_3_3_2_38_2","unstructured":"ntop.org. [n. d.]. PF_RING \u2014 ntop.org. online. https:\/\/www.ntop.org\/products\/packet-capture\/pf_ring\/"},{"key":"e_1_3_3_2_39_2","doi-asserted-by":"publisher","DOI":"10.1145\/863955.863994"},{"key":"e_1_3_3_2_40_2","doi-asserted-by":"crossref","unstructured":"Craig Partridge and Mark Allman. 2016. Ethical considerations in network measurement papers. Commun. ACM 59 10 (2016) 58\u201364.","DOI":"10.1145\/2896816"},{"key":"e_1_3_3_2_41_2","unstructured":"Jeffrey Paul. 2020. Your Computer Isn\u2019t Yours. online. https:\/\/sneak.berlin\/20201112\/your-computer-isnt-yours\/ Accessed: 9 March 2025."},{"key":"e_1_3_3_2_42_2","doi-asserted-by":"publisher","DOI":"10.14722\/ethics.2023.239547"},{"key":"e_1_3_3_2_43_2","first-page":"14","volume-title":"NSDI","author":"Perdisci Roberto","year":"2010","unstructured":"Roberto Perdisci, Wenke Lee, and Nick Feamster. 2010. Behavioral clustering of http-based malware and signature generation using malicious network traces.. In NSDI , Vol.\u00a010. 14."},{"key":"e_1_3_3_2_44_2","doi-asserted-by":"publisher","DOI":"10.1145\/3560835.3564551"},{"key":"e_1_3_3_2_45_2","unstructured":"Esther Rodriguez Lobsang Gyatso Tenzin Thayai and Jedidiah\u00a0R Crandall. 2025. Revisiting BAT Browsers: Protecting At-Risk Populations from Surveillance Censorship and Targeted Attacks. Free and Open Communications on the Internet (2025)."},{"key":"e_1_3_3_2_46_2","volume-title":"A Security and Privacy Audit of KakaoTalk\u2019s End-to-End Encryption","author":"Schmidt Dawin","year":"2016","unstructured":"Dawin Schmidt. 2016. A Security and Privacy Audit of KakaoTalk\u2019s End-to-End Encryption. Technical Report. https:\/\/www.diva-portal.org\/smash\/get\/diva2:1046438\/FULLTEXT01.pdf"},{"key":"e_1_3_3_2_47_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-29889-9_15"},{"key":"e_1_3_3_2_48_2","doi-asserted-by":"publisher","DOI":"10.1145\/3419394.3423645"},{"key":"e_1_3_3_2_49_2","doi-asserted-by":"publisher","DOI":"10.5555\/1251254.1251258"},{"key":"e_1_3_3_2_50_2","doi-asserted-by":"crossref","unstructured":"Karen Sparck\u00a0Jones. 1972. A statistical interpretation of term specificity and its application in retrieval. Journal of documentation 28 1 (1972) 11\u201321.","DOI":"10.1108\/eb026526"},{"key":"e_1_3_3_2_51_2","first-page":"195","volume-title":"Workshop on Mobile Security Technologies (MoST)","author":"Stevens Ryan","year":"2012","unstructured":"Ryan Stevens, Clint Gibler, Jon Crussell, Jeremy Erickson, and Hao Chen. 2012. Investigating user privacy in android ad libraries. In Workshop on Mobile Security Technologies (MoST) , Vol.\u00a010. 195\u2013197."},{"key":"e_1_3_3_2_52_2","doi-asserted-by":"publisher","DOI":"10.1145\/3487552.3487828"},{"key":"e_1_3_3_2_53_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-662-54970-4_22"},{"key":"e_1_3_3_2_54_2","first-page":"227","volume-title":"International Workshop on Recent Advances in Intrusion Detection","author":"Wang Ke","year":"2005","unstructured":"Ke Wang, Gabriela Cretu, and Salvatore\u00a0J Stolfo. 2005. Anomalous payload-based worm detection and signature generation. In International Workshop on Recent Advances in Intrusion Detection. Springer, 227\u2013246."},{"key":"e_1_3_3_2_55_2","unstructured":"Knockel\u00a0J. Wang\u00a0M. Lin\u00a0P.[n. d.]. Should We Chat? Privacy in the WeChat Ecosystem. https:\/\/citizenlab.ca\/2023\/06\/privacy-in-the-wechat-ecosystem-full-report\/ Accessed : 31 May 2024."},{"key":"e_1_3_3_2_56_2","doi-asserted-by":"publisher","DOI":"10.1145\/2486001.2486008"},{"key":"e_1_3_3_2_57_2","unstructured":"Zeek [n. d.]. The Zeek Network Security Monitor. online. https:\/\/zeek.org\/"}],"event":{"name":"CCS '25: ACM SIGSAC Conference on Computer and Communications Security","location":"Taipei Taiwan","acronym":"WPES '25","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 24th Workshop on Privacy in the Electronic Society"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3733802.3764059","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3733802.3764059","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,1,9]],"date-time":"2026-01-09T18:55:48Z","timestamp":1767984948000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3733802.3764059"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,10,13]]},"references-count":56,"alternative-id":["10.1145\/3733802.3764059","10.1145\/3733802"],"URL":"https:\/\/doi.org\/10.1145\/3733802.3764059","relation":{},"subject":[],"published":{"date-parts":[[2025,10,13]]},"assertion":[{"value":"2025-11-18","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}