{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,27]],"date-time":"2026-05-27T21:56:38Z","timestamp":1779918998685,"version":"3.53.1"},"reference-count":42,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2024,1,1]],"date-time":"2024-01-01T00:00:00Z","timestamp":1704067200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2024,1,1]],"date-time":"2024-01-01T00:00:00Z","timestamp":1704067200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"crossref","award":["62172093"],"award-info":[{"award-number":["62172093"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Cybersecurity"],"abstract":"<jats:title>Abstract<\/jats:title><jats:p>Fine-grained function-level encrypted traffic classification is an essential approach to maintaining network security. Machine learning and deep learning have become mainstream methods to analyze traffic, and labeled dataset construction is the basis. Android occupies a huge share of the mobile operating system market. Instant Messaging (IM) applications are important tools for people communication. But such applications have complex functions which frequently switched, so it is difficult to obtain function-level labels. The existing function-level public datasets in Android are rare and noisy, leading to research stagnation. Most labeled samples are collected with WLAN devices, which cannot exclude the operating system background traffic. At the same time, other datasets need to obtain root permission or use scripts to simulate user behavior. These collecting methods either destroy the security of the mobile device or ignore the real operation features of users with coarse-grained. Previous work (Chen et al. in Appl Sci 12(22):11731, 2022) proposed a one-stop automated encrypted traffic labeled sample collection, construction, and correlation system, A3C, running at the application-level in Android. This paper analyzes the display characteristics of IM and proposes a function-level low-overhead labeled encrypted traffic datasets construction method for Android, F3L. The supplementary method to A3C monitors UI controls and layouts of the Android system in the foreground. It selects the feature fields of attributes of them for different in-app functions to build an in-app function label matching library for target applications and in-app functions. The deviation of timestamp between function invocation and label identification completion is calibrated to cut traffic samples and map them to corresponding labels. Experiments show that the method can match the correct label within 3\u00a0s after the user operation.<\/jats:p>","DOI":"10.1186\/s42400-023-00185-6","type":"journal-article","created":{"date-parts":[[2024,1,1]],"date-time":"2024-01-01T02:06:04Z","timestamp":1704074764000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":5,"title":["F3l: an automated and secure function-level low-overhead labeled encrypted traffic dataset construction method for IM in Android"],"prefix":"10.1186","volume":"7","author":[{"given":"Keya","family":"Xu","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Guang","family":"Cheng","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2024,1,1]]},"reference":[{"key":"185_CR1","doi-asserted-by":"crossref","unstructured":"Aceto G, Ciuonzo D, Montieri A, Nascita A, Pescap\u00e9 A (2021) Encrypted multitask traffic classification via multimodal deep learning. In: ICC 2021-IEEE international conference on communications, IEEE, pp 1\u20136","DOI":"10.1109\/ICC42927.2021.9500316"},{"issue":"17","key":"185_CR2","doi-asserted-by":"publisher","first-page":"7789","DOI":"10.3390\/app11177789","volume":"11","author":"A Afzal","year":"2021","unstructured":"Afzal A, Hussain M, Saleem S, Shahzad MK, Ho AT, Jung K-H (2021) Encrypted network traffic analysis of secure instant messaging application: a case study of signal messenger app. Appl Sci 11(17):7789","journal-title":"Appl Sci"},{"key":"185_CR3","doi-asserted-by":"crossref","unstructured":"Bahuguna A, Agrawal A, Bhatia A, Tiwari K, Vishwakarma D (2021) User profiling using smartphone network traffic analysis. In: 2021 international conference on communication systems and NETworkS (COMSNETS), IEEE, pp 69\u201373","DOI":"10.1109\/COMSNETS51098.2021.9352901"},{"key":"185_CR4","doi-asserted-by":"crossref","unstructured":"Banihashemi SB, Aktharkavan E (2022) Encrypted network traffic classification using deep learning method. In: 2022 8th international conference on web research (ICWR), IEEE, pp 1\u20138","DOI":"10.1109\/ICWR54782.2022.9786247"},{"key":"185_CR5","doi-asserted-by":"crossref","unstructured":"Bartolec I, Orsolic I, Skorin-Kapov L (2020) Inclusion of end user playback-related interactions in youtube video data collection and ml-based performance model training. In: 2020 twelfth international conference on quality of multimedia experience (QoMEX), IEEE, pp 1\u20136","DOI":"10.1109\/QoMEX48832.2020.9123107"},{"key":"185_CR6","doi-asserted-by":"crossref","unstructured":"Cai W, Gou G, Jiang M, Liu C, Xiong G, Li Z (2021) Memg: mobile encrypted traffic classification with Markov chains and graph neural network. In: 2021 IEEE 23rd int conf on high performance computing and communications; 7th Int Conf on data science and systems; 19th Int Conf on Smart City; 7th Int Conf on dependability in sensor, cloud and big data systems and Application (HPCC\/DSS\/SmartCity\/DependSys), IEEE, pp 478\u2013486","DOI":"10.1109\/HPCC-DSS-SmartCity-DependSys53884.2021.00087"},{"issue":"22","key":"185_CR7","doi-asserted-by":"publisher","first-page":"11731","DOI":"10.3390\/app122211731","volume":"12","author":"Z Chen","year":"2022","unstructured":"Chen Z, Cheng G, Xu Z, Xu K, Shan Y, Zhang J (2022) A3c system: one-stop automated encrypted traffic labeled sample collection, construction and correlation in multi-systems. Appl Sci 12(22):11731","journal-title":"Appl Sci"},{"key":"185_CR8","doi-asserted-by":"crossref","unstructured":"Chen Z, Cheng G, Jiang B, Tang S, Guo S, Zhou Y (2020) Length matters: fast internet encrypted traffic service classification based on multi-pdu lengths. In: 2020 16th international conference on mobility, sensing and networking (MSN), IEEE, pp 531\u2013538","DOI":"10.1109\/MSN50589.2020.00089"},{"key":"185_CR9","unstructured":"CNNIC: The 50th Statistical Report on China\u2019s Internet Development. China Internet Network Information Center (2022)"},{"issue":"1","key":"185_CR10","doi-asserted-by":"publisher","first-page":"114","DOI":"10.1109\/TIFS.2015.2478741","volume":"11","author":"M Conti","year":"2015","unstructured":"Conti M, Mancini LV, Spolaor R, Verde NV (2015) Analyzing Android encrypted network traffic to identify user actions. IEEE Trans Inf Forens Secur 11(1):114\u2013125","journal-title":"IEEE Trans Inf Forens Secur"},{"key":"185_CR11","doi-asserted-by":"crossref","unstructured":"Conti M, Mancini LV, Spolaor R, Verde NV (2015) Can\u2019t you hear me knocking: identification of user actions on Android apps via traffic analysis. In: Proceedings of the 5th ACM conference on data and application security and privacy, pp 297\u2013304","DOI":"10.1145\/2699026.2699119"},{"key":"185_CR12","doi-asserted-by":"crossref","unstructured":"Dai S, Tongaonkar A, Wang X, Nucci A, Song D (2013) Networkprofiler: towards automatic fingerprinting of Android apps. In: 2013 proceedings IEEE INFOCOM, IEEE, pp 809\u2013817","DOI":"10.1109\/INFCOM.2013.6566868"},{"key":"185_CR13","doi-asserted-by":"crossref","unstructured":"Deng Q, Li Z, Wu Q, Xu C, Xie G (2017) An empirical study of the wechat mobile instant messaging service. In: 2017 IEEE conference on computer communications workshops (INFOCOM WKSHPS), IEEE, pp 390\u2013395","DOI":"10.1109\/INFCOMW.2017.8116408"},{"key":"185_CR14","unstructured":"Developers: create your own accessibility service, (2022). https:\/\/developer.android.com\/guide\/topics\/ui\/accessibility\/service?hl=en. Accessed 12 Dec 2022"},{"key":"185_CR15","doi-asserted-by":"crossref","unstructured":"Draper-Gil G, Lashkari AH, Mamun MSI, Ghorbani AA (2016) Characterization of encrypted and vpn traffic using time-related. In: Proceedings of the 2nd international conference on information systems security and privacy (ICISSP), pp 407\u2013414","DOI":"10.5220\/0005740704070414"},{"issue":"11","key":"185_CR16","doi-asserted-by":"publisher","first-page":"2851","DOI":"10.1109\/TMC.2016.2516020","volume":"15","author":"Y Fu","year":"2016","unstructured":"Fu Y, Xiong H, Lu X, Yang J, Chen C (2016) Service usage classification with encrypted internet traffic in mobile messaging apps. IEEE Trans Mob Comput 15(11):2851\u20132864","journal-title":"IEEE Trans Mob Comput"},{"key":"185_CR17","doi-asserted-by":"crossref","unstructured":"Hou C, Shi J, Kang C, Cao Z, Gang X (2018) Classifying user activities in the encrypted wechat traffic. In: 2018 IEEE 37th international performance computing and communications conference (IPCCC), IEEE, pp 1\u20138","DOI":"10.1109\/PCCC.2018.8711267"},{"key":"185_CR18","doi-asserted-by":"crossref","unstructured":"Huabing Z, Sisi Y, Xiaoming C, Zhida L (2021) Real-time detection method for mobile network traffic anomalies considering user behavior security monitoring. In: 2021 international conference on computer, blockchain and financial development (CBFD), IEEE, pp 11\u201316","DOI":"10.1109\/CBFD52659.2021.00010"},{"key":"185_CR19","unstructured":"IETF: TLS Encrypted Client Hello. https:\/\/www.ietf.org\/archive\/id\/draft-ietf-tls-esni-15.txt. 2022-12-12 (2022)"},{"key":"185_CR20","doi-asserted-by":"crossref","unstructured":"Lin CY, Chen B, Lan W (2022) An efficient approach for encrypted traffic classification using cnn and bidirectional gru. In: 2022 2nd international conference on consumer electronics and computer engineering (ICCECE), IEEE, pp 368\u2013373","DOI":"10.1109\/ICCECE54139.2022.9712708"},{"issue":"1","key":"185_CR21","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1038\/s41597-022-01418-y","volume":"9","author":"F Loh","year":"2022","unstructured":"Loh F, Wamser F, Poign\u00e9e F, Gei\u00dfler S, Ho\u00dffeld T (2022) Youtube dataset on mobile streaming for internet traffic modeling and streaming analysis. Sci Data 9(1):1\u201312","journal-title":"Sci Data"},{"key":"185_CR22","doi-asserted-by":"crossref","unstructured":"Maonan W, Kangfeng Z, Ning X, Yanqing Y, Xiujuan W (2021) Centime: a direct comprehensive traffic features extraction for encrypted traffic classification. In: 2021 IEEE 6th international conference on computer and communication systems (ICCCS), IEEE, pp 490\u2013498","DOI":"10.1109\/ICCCS52626.2021.9449280"},{"key":"185_CR23","unstructured":"Microsoft: About Think Time, (2012). https:\/\/docs.microsoft.com\/en-us\/previous-versions\/visualstudio\/visual-studio-2008\/ms184790(v=vs.90)?redirectedfrom=MSDN. Accessed 12 Dec 2022"},{"key":"185_CR24","unstructured":"Saltaformaggio B, Choi H, Johnson K, Kwon Y, Zhang Q, Zhang X, Xu D, Qian J (2016) Eavesdropping on $$\\{$$Fine-Grained$$\\}$$ user activities within smartphone apps over encrypted network traffic. In: 10th USENIX workshop on offensive technologies (WOOT 16)"},{"key":"185_CR25","doi-asserted-by":"crossref","unstructured":"Satrabhandhu W, Tritilanunt S (2021) Encrypted traffic characterization using none zero payload and payload ratio characteristics. In: 2021 25th international computer science and engineering conference (ICSEC), IEEE, pp 63\u201369","DOI":"10.1109\/ICSEC53205.2021.9684630"},{"key":"185_CR26","doi-asserted-by":"crossref","unstructured":"Shafiq M, Yu X, Laghari AA, Yao L, Karn NK, Abdesssamia F, et al (2016) Wechat text and picture messages service flow traffic classification using machine learning technique. In: 2016 IEEE 18th international conference on high performance computing and communications; IEEE 14th international conference on smart city; IEEE 2nd international conference on data science and systems (HPCC\/SmartCity\/DSS), IEEE, pp 58\u201362","DOI":"10.1109\/HPCC-SmartCity-DSS.2016.0019"},{"key":"185_CR27","doi-asserted-by":"crossref","unstructured":"Sharif MS, Moein M (2021) An effective cost-sensitive convolutional neural network for network traffic classification. In: 2021 International conference on innovation and intelligence for informatics, computing, and technologies (3ICT), IEEE, pp 40\u201345","DOI":"10.1109\/3ICT53449.2021.9581789"},{"key":"185_CR28","doi-asserted-by":"publisher","first-page":"2046","DOI":"10.1109\/TIFS.2020.3046876","volume":"16","author":"M Shen","year":"2020","unstructured":"Shen M, Liu Y, Zhu L, Du X, Hu J (2020) Fine-grained webpage fingerprinting using only packet length information of encrypted traffic. IEEE Trans Inf Forens Secur 16:2046\u20132059","journal-title":"IEEE Trans Inf Forens Secur"},{"key":"185_CR29","unstructured":"Statista: Mobile operating systems\u2019 market share worldwide from 1st quarter 2009 to 4th quarter 2022, (2022). https:\/\/www.statista.com\/statistics\/272698\/global-market-share-held-by-mobile-operating-systems-since-2009. Accessed 12 Dec 2022"},{"key":"185_CR30","doi-asserted-by":"crossref","unstructured":"Sun B, Yang W, Yan M, Wu D, Zhu Y, Bai Z (2020) An encrypted traffic classification method combining graph convolutional network and autoencoder. In: 2020 IEEE 39th international performance computing and communications conference (IPCCC), IEEE, pp 1\u20138","DOI":"10.1109\/IPCCC50635.2020.9391542"},{"key":"185_CR31","doi-asserted-by":"crossref","unstructured":"Vasudevan S, Jain K, Su C-J (2021) Machine learning based encrypted traffic classification using estimated application layer statistics. In: 38th international communications satellite systems conference (ICSSC 2021), IET, vol. 2021, pp 189\u2013194","DOI":"10.1049\/icp.2022.0570"},{"issue":"5","key":"185_CR32","doi-asserted-by":"publisher","first-page":"355","DOI":"10.1002\/nem.1901","volume":"25","author":"P Velan","year":"2015","unstructured":"Velan P, \u010cerm\u00e1k M, \u010celeda P, Dra\u0161ar M (2015) A survey of methods for encrypted traffic classification and analysis. Int J Netw Manag 25(5):355\u2013374","journal-title":"Int J Netw Manag"},{"key":"185_CR33","doi-asserted-by":"publisher","first-page":"182065","DOI":"10.1109\/ACCESS.2020.3029190","volume":"8","author":"X Wang","year":"2020","unstructured":"Wang X, Chen S, Su J (2020) Automatic mobile app identification from encrypted traffic with hybrid neural networks. IEEE Access 8:182065\u2013182077","journal-title":"IEEE Access"},{"key":"185_CR34","doi-asserted-by":"crossref","unstructured":"Wang P, Li S, Ye F, Wang Z, Zhang M (2020) Packetcgan: exploratory study of class imbalance for encrypted traffic classification using cgan. In: ICC 2020-2020 IEEE international conference on communications (ICC), IEEE, pp 1\u20137","DOI":"10.1109\/ICC40277.2020.9148946"},{"key":"185_CR35","doi-asserted-by":"crossref","unstructured":"Wei X, Gomez L, Neamtiu I, Faloutsos M (2012) Profiledroid: multi-layer profiling of Android applications. In: Proceedings of the 18th annual international conference on mobile computing and networking, pp 137\u2013148","DOI":"10.1145\/2348543.2348563"},{"issue":"6","key":"185_CR36","doi-asserted-by":"publisher","first-page":"3674","DOI":"10.1007\/s12083-021-01214-2","volume":"14","author":"H Wu","year":"2021","unstructured":"Wu H, Wu Q, Cheng G, Guo S, Hu X, Yan S (2021) Sfim: identify user behavior based on stable features. Peer-to-Peer Network Appl 14(6):3674\u20133687","journal-title":"Peer-to-Peer Network Appl"},{"key":"185_CR37","doi-asserted-by":"crossref","unstructured":"Yang B, Liu D (2019) Research on network traffic identification based on machine learning and deep packet inspection. In: 2019 IEEE 3rd information technology, networking, electronic and automation control conference (ITNEC), IEEE, pp 1887\u20131891","DOI":"10.1109\/ITNEC.2019.8729153"},{"key":"185_CR38","doi-asserted-by":"crossref","unstructured":"Yan F, Xu M, Qiao T, Wu T, Yang X, Zheng N, Choo K-KR (2018) Identifying wechat red packets and fund transfers via analyzing encrypted network traffic. In: 2018 17th IEEE international conference on trust, security and privacy in computing and communications\/12th IEEE international conference on big data science and engineering (TrustCom\/BigDataSE), IEEE, pp 1426\u20131432","DOI":"10.1109\/TrustCom\/BigDataSE.2018.00198"},{"issue":"1","key":"185_CR39","doi-asserted-by":"publisher","first-page":"241","DOI":"10.1109\/TBDATA.2019.2940675","volume":"8","author":"H Yao","year":"2019","unstructured":"Yao H, Liu C, Zhang P, Wu S, Jiang C, Yu S (2019) Identification of encrypted traffic through attention mechanism based long short term memory. IEEE Trans Big Data 8(1):241\u2013252","journal-title":"IEEE Trans Big Data"},{"key":"185_CR40","doi-asserted-by":"crossref","unstructured":"Zhang C, An C, Wang JH, Zhao Z, Yu T, Wang J (2021) Safsn: a self-attention based neural network for encrypted mobile traffic classification. In: 2021 IEEE international conferences on Internet of Things (iThings) and IEEE green computing and communications (GreenCom) and IEEE cyber, physical and social computing (CPSCom) and IEEE smart data (SmartData) and IEEE congress on cybermatics (Cybermatics), IEEE, pp 330\u2013337","DOI":"10.1109\/iThings-GreenCom-CPSCom-SmartData-Cybermatics53846.2021.00060"},{"key":"185_CR41","doi-asserted-by":"crossref","unstructured":"Zhao Y, Yang Y, Niu Y, Wu K, Hao Y, Su H, Zhao Q (2021) A classification and identification technology of tls encrypted traffic applications. In: 2021 IEEE 4th international conference on big data and artificial intelligence (BDAI), IEEE, pp 160\u2013164","DOI":"10.1109\/BDAI52447.2021.9515274"},{"key":"185_CR42","doi-asserted-by":"crossref","unstructured":"Zhou Y, Shi H, Zhao Y, Gao W, Zhang W (2021) Encrypted network traffic identification based on 2d-cnn model. In: 2021 22nd Asia-Pacific network operations and management symposium (APNOMS), IEEE, pp 238\u2013241","DOI":"10.23919\/APNOMS52696.2021.9562636"}],"container-title":["Cybersecurity"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s42400-023-00185-6.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1186\/s42400-023-00185-6\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s42400-023-00185-6.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,1,1]],"date-time":"2024-01-01T02:06:53Z","timestamp":1704074813000},"score":1,"resource":{"primary":{"URL":"https:\/\/cybersecurity.springeropen.com\/articles\/10.1186\/s42400-023-00185-6"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,1,1]]},"references-count":42,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2024,12]]}},"alternative-id":["185"],"URL":"https:\/\/doi.org\/10.1186\/s42400-023-00185-6","relation":{},"ISSN":["2523-3246"],"issn-type":[{"value":"2523-3246","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,1,1]]},"assertion":[{"value":"10 May 2023","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"22 August 2023","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"1 January 2024","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare that they have no competing interests.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Competing interests"}}],"article-number":"1"}}