Package: appscanner
AppScannerThis code was implemented as part of the NDSS FlowPrint [1] paper, it implements the Single Large Random Forest Classifier of AppScanner [2]. We ask people to cite both works when using the software for academic research papers.InstallationUsing pipThe easiest way to installappscanneris using pippip install appscannerManuallyIf you would like to install appscanner manually, please make sure you have installed the required dependencies.DependenciesThis code is written in Python3 and depends on the following libraries:NumpyPandasScikit-learnScapyTo install these use the following commandpip install -U scapy numpy pandas scikit-learnUsageThe AppScanner implementation can be tested with themain.pyscript. This script allows you to specify .pcap files to load. After loading, the script splits the data into training and testing data and evaluates the performance. Seemain.py --helpfor more information.APIIt is also possible to directly use the AppScanner code as an API. There are two main classes which need to be understood.appscanner.preprocessor.Preprocessorfor extracting features from.pcapfiles.appscanner.appscanner.AppScannerfor applying the AppScanner detection.PreprocessorThePreprocessorobject is used to extract data from.pcapfiles and label them. To this end, it uses theprocessfunction which requires a list of files and a list of labels. The list of files must be pathnames to pcap files. The list of labels must be labels corresponding to each file. The example below shows how thePreprocessorcan be used.Examplefromappscanner.preprocessorimportPreprocessor# Create objectpreprocessor=Preprocessor()# Load from filesX,y=preprocessor.process(['<path_file_1>',...,'<path_file_n>'],['<label_1>',...,'<label_n>'])AppScannerTheAppScannerobject is used to find known applications in network traffic. AppScanner requires a confidencethreshold(default=0.9). The threshold means AppScanner only returns labels for which it is confident enough or-1otherwise, a threshold of 0 gives labels for every predicted sample. It can befitwithX_trainandy_trainarrays obtained by thePreprocessor. After it has beenfit, theAppScanneris able topredictunknown samplesX_test. The example below shows howAppScannercan be used.Examplefromappscanner.appscannerimportAppScanner# Create objectscanner=AppScanner(threshold=0.9)# Fit scannerscanner.fit(X_train,y_train)# Predict labels of test datay_pred=scanner.predict(X_test)References[1]van Ede, T., Bortolameotti, R., Continella, A., Ren, J., Dubois, D. J., Lindorfer, M., Choffnes, D., van Steen, M. & Peter, A. (2020, February). FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic. In 2020 NDSS. The Internet Society.[2]Taylor, V. F., Spolaor, R., Conti, M., & Martinovic, I. (2016, March). Appscanner: Automatic fingerprinting of smartphone apps from encrypted network traffic. In 2016 IEEE European Symposium on Security and Privacy (EuroS&P) (pp. 439-454). IEEE.Bibtex@inproceedings{vanede2020flowprint,
  title={{FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic}},
  author={van Ede, Thijs and Bortolameotti, Riccardo and Continella, Andrea and Ren, Jingjing and Dubois, Daniel J. and Lindorfer, Martina and Choffness, David and van Steen, Maarten, and Peter, Andreas}
  booktitle={NDSS},
  year={2020},
  organization={The Internet Society}
}@inproceedings{taylor2016appscanner,
  title={Appscanner: Automatic fingerprinting of smartphone apps from encrypted network traffic},
  author={Taylor, Vincent F and Spolaor, Riccardo and Conti, Mauro and Martinovic, Ivan},
  booktitle={2016 IEEE European Symposium on Security and Privacy (EuroS\&P)},
  pages={439--454},
  year={2016},
  organization={IEEE}
}