# CNN for User Activity Detection Using Encrypted In-App Mobile Data
## 3 Proposed Methodology
### Data Collection  
For this research, a data set was created that consisted of network traffic from in-app activities of eight popular mobile apps, namely, Facebook, Instagram, YouTube, Viber, WhatsApp, Gmail, Skype, and Messenger. To obtain the ground truth, network traffic generated after executing each activity was collected separately, and the network trace was labeled with the name of the activity performed. Each app was run separately, thus limiting the presence of background traffic. To generate a sufficient number of traffic flows for inference, each activity was repeated four times and captured traffic was saved as.pcap files. The number of in-app activities considered in each app and number of samples obtained after segmenting the traffic into 1, 0.5, 0.2, and 0.1 s time intervals are presented in Table 1. The 92 in-app activities considered in this research are given in Appendix A.  
We monitored the network passively and traffic was captured without connecting to the wireless network to which the target user's mobile device was connected. The traffic transmitting within the wireless network was sniffed using Airmon-ng and Airodump-ng sniffing tools from the Aircrack-ng suite [28]. Default setting of network adapters allow only to capture packets that are sent to them. To capture all traffic, we set the network adapter to its monitor mode. The experimental testbed used to sniff traffic is shown in Figure 2. The internet access to the smartphone was provided over a wireless connection via a router. The smartphone was connected to the wireless network exclusively to avoid interference from other sources. The network adapter (Alfa AWUS036 NHA) was plugged to the laptop (Toshiba PORTEGE Z30-C), which was used to capture the network traffic.  
\begin{table}
\begin{tabular}{c c c c c c c} \hline \hline \multirow{2}{*}{**App**} & \multirow{2}{*}{**Category**} & \multirow{2}{*}{**No. of in-App**} & \multicolumn{5}{c}{**Number of Samples**} \\ \cline{3-8}  & & & **Activities** & **1 s** & **0.5 s** & **0.2 s** & **0.1 s** \\ \hline \multirow{2}{*}{Facebook} & Social networking & \multirow{2}{*}{22} & \multirow{2}{*}{9477} & \multirow{2}{*}{19,944} & \multirow{2}{*}{55,283} & \multirow{2}{*}{110,588} \\ \hline \multirow{2}{*}{Instagram} & Photo and video & \multirow{2}{*}{20} & \multirow{2}{*}{2907} & \multirow{2}{*}{6818} & \multirow{2}{*}{25,529} & \multirow{2}{*}{81,505} \\ \hline \multirow{2}{*}{Gmail} & Productivity & 5 & 561 & 1036 & 2361 & 5514 \\ \hline \multirow{2}{*}{Messenger} & Social networking & \multirow{2}{*}{10} & \multirow{2}{*}{2199} & \multirow{2}{*}{6061} & \multirow{2}{*}{18,514} & \multirow{2}{*}{43,113} \\ \hline \multirow{2}{*}{Skype} & Social networking & \multirow{2}{*}{8} & \multirow{2}{*}{5436} & \multirow{2}{*}{15,703} & \multirow{2}{*}{69,884} & \multirow{2}{*}{211,981} \\ \hline \multirow{2}{*}{Viber} & Social networking & \multirow{2}{*}{9} & \multirow{2}{*}{434} & \multirow{2}{*}{690} & \multirow{2}{*}{1207} & \multirow{2}{*}{1875} \\ \hline \multirow{2}{*}{WhatsApp} & Social networking & \multirow{2}{*}{9} & \multirow{2}{*}{273} & \multirow{2}{*}{436} & \multirow{2}{*}{873} & \multirow{2}{*}{1458} \\ \hline \multirow{2}{*}{YouTube} & Photo and video & \multirow{2}{*}{9} & \multirow{2}{*}{5161} & \multirow{2}{*}{14,501} & \multirow{2}{*}{58,173} & \multirow{2}{*}{207,013} \\ \hline \multicolumn{2}{c}{Total 8 apps} & \multirow{2}{*}{92} & \multirow{2}{*}{26,448} & \multirow{2}{*}{65,189} & \multirow{2}{*}{231,824} & \multirow{2}{*}{663,047} \\ \hline \hline \end{tabular}
\end{table}
Table 1: Features of the collected data set.  
Figure 2: Experimental testbed for data collection.