# CNN for User Activity Detection Using Encrypted In-App Mobile Data
## 3 Proposed Methodology
### Network Traffic to Image  
Pre-processing needed to be applied on the captured traffic flows prior to mapping traffic data into images. The following pre-processing steps were performed on the obtained data set in this work. 1. Sanitization  
The three main frame types used in WLAN (IEEE 802.11) are data, control, and management frames. Only the data frames are used for data transmission. The presence of the other two types may hinder the process of analysis; therefore, the control and management frames were eliminated, and only data frames were processed further. There were data frames that did not carry data. Keeping these frames would cause bias in training the CNN [29]. Therefore, null data frames were also eliminated at this stage. 2. Normalization  
Normalization is an important step in data pre-processing to avoid having different scales of feature vectors and, thus, improves integrity of data. The data set contained feature values in different scales that may lead to obtaining biased results. To normalize the feature values, the standard scaler [30] was used, which normalizes each feature by removing its mean and scaling to unit variance. This equalizes the importance of all features and allows DL methods to converge faster. For each original value X with a mean \(\mu\) and standard deviation \(\sigma\), its normalized value X' can be determined from (1):  
\[\mathrm{X^{\prime}=(X-\mu)/\sigma} \tag{1}\]
3. Segmentation  
During in-app activity detection, it is not possible to guarantee that the entire transaction of an activity can be observed. There can be situations where the eavesdropper starts to capture the traffic while the user is already performing an activity. In these instances, the eavesdropper can capture only a part of the traffic flow instead of the entire flow transaction. To perform in-app activity detection even by observing only a part of an activity related traffic, time windows are used to divide the traffic flows into segments. A thorough analysis of the sensitivity of this approach was performed by conducting experiments with different time window sizes: 1, 0.5, 0.2, and 0.1 s as discussed in Section 4.1. Following network traffic pre-processing, each segmented traffic sample was converted into an image, where features and corresponding feature values were represented by pixels and pixel intensities, respectively. In this work two sets of data images were generated that used different color schemes. These were grayscale and red, green, and blue (RGB). If the segmented traffic sample, \(S\), has \(n\) number of frames and \(m\) number of data values, then the value of \(m\)th data at \(n\)th frame can be represented as \(A_{nm}\). The segment \(S\) is represented as matrix (2):  
\[S=\left[ \begin{array}{ccc}A_{11}&\cdots&A_{1m}\\ \vdots&\ddots&\vdots\\ A_{n1}&\cdots&A_{nm}\end{array} \right] \tag{2}\]  
The three main side channel data considered in this work were frame length, data length, and inter arrival time. Segment S comprised values of these side channel data. Based on these data, individual vectors were created. The division can be expressed as matrix (3):  
\[\mathrm{X_{i}=[A_{1i},\,A_{2i},\ldots\,A_{ni}]} \tag{3}\]  
where n is the number of frames and \(\mathrm{X_{i}}\) represents all data values of the ith side channel data. The number of vectors that are created depends on the number of side channel data. In this research, three side channel data were considered; thus, three vectors were created. When employing a grayscale model, these three vectors combined to form one vector. Whereas in the RGB model, these were passed together as three separate vectors. If the image size is very small, then it cannot be sent through the required number of convolutional layers, because after each layer, the size is reduced. Therefore, resizing was applied to match with the respective pre-defined input image size. Each element in the matrix is treated as a pixel with the grayscale value of the pixel, where the color intensity is proportional to the matrix value.