Classification of Smartphone Users Using Internet Traffic

ABSTRACT Today, smartphone devices are owned by a large portion of the population and have become a very popular plat- form for accessing the Internet. Smartphones provide the user with immediate access to information and services. However, they can easily expose the user to many privacy risks. Applications that are installed on the device and entities with access to the device’s Internet traffic can re- veal private information about the smartphone user and steal sensitive content stored on the device or transmitted by the device over the Internet. In this paper, we present a method to reveal various demographics and technical computer skills of smartphone users by their Internet traf- fic records, using machine learning classification models. We implement and evaluate the method on real life data of smartphone users and show that smartphone users can be classified by their gender, smoking habits, software programming experience, and other characteristics. INTRODUCTION In recent years, the number of smartphone users has rap- idly increased. According to a report published by Smart Insights1, the number of smartphone users grew from 400 million users in 2007, to more than 1,800 million in 2015. In addition, the report claims that at the end of 2015, 97% of adults, aged 18 to 34, in the US were mobile device us- ers. The mobility and capabilities of smartphones make them a very popular platform for Internet usage. Accord- ing to [1], approximately two thirds of the adult popula- tion (ages 16 and over) in the UK use smartphones to go online, and the number increases to 90% among adults aged 16 to 34. The various functionalities of smartphones make them very useful devices, however these capabilities also pose a great privacy risk to smartphone users [2]. In many cas- es, smartphone users store sensitive information such as private photos and passwords on their devices. Moreo- ver, smartphones give applications access to sensors such as GPS, gyroscope, and accelerometer. These, and other sensors, can be used to reveal information about the user, including activity recognition [3] and demographic prop- erties (e.g., gender) [4], by malicious applications installed on the device. However, the privacy risks smartphone users are exposed to are not limited to device applications. The Internet ex- poses smartphone users to many other entities that may violate user privacy. Public Wi-Fi networks, ISP provid-

1http://www.smartinsights.com/mobile-marketing/mobile- marketing-analytics/mobile-marketing-statistics/ ers, VPN (virtual private network) services, and proxy servers are examples of entities that have access to the Internet traffic of smartphone users. This traffic may con- tain sensitive information transmitted in plain text (e.g., HTTP forms). However, recent studies show that private information regarding the user may be extracted from Internet traffic using machine learning techniques. In [5], the authors extract statistical and application and catego- ry-based features from the traffic and use location proper- ties of the hotspot to show how public Wi-Fi can reveal the gender and education of its users. In [6], a scenario where remote entities with access to the user’s smartphone Internet (e.g., VPN services) can use it to identify the type of venue (home, organization, hangout, and waiting place) the user is located at. In this paper, we present a method for classifying smartphone users by various demographic properties and computer technical skills. The method analyzes and ag- gregates smartphones’ Internet traffic records to extract features that represent the smartphone user. The feature extraction process uses feature extraction techniques that were introduced in [5] and [7], which are enriched with additional new features defined in this study. By apply- ing a supervised machine learning approach, we were able to classify smartphone users by 10 different proper- ties including their gender, age group, and education. The method was demonstrated and evaluated on real data (network traffic) of 143 smartphone users collected dur- ing 2014 and 2015; for example, we were able to classify the users by their gender and software programing expe- rience with an accuracy of 83.9% and 77.8%, respectively. METHOD Mobile Internet traffic datasets are not publicly available due to their sensitive nature in terms of privacy. There- fore, first we had to collect such data from smartphone users by conducting an experiment. In addition, at the start of the experiment, the users were asked to complete a questionnaire to tell us about themselves and their technical computer skills. After the data was collected, the traffi

…(Full text truncated)…