toolkit code , which allows for the identification of network mobile applications by analyzing the encrypted traffic generated during the application's operation. It is possible to define both typical programs for which statistics have been accumulated and to identify the activity of new applications. The code is written in Python and is licensed under the MIT License.
The program implements , defining the characteristics of data exchange specific to different applications (delays between packets, data stream features, changes in packet sizes, TLS session characteristics, etc.). For Android and iOS mobile applications, the detection accuracy is 89.2%. In the first five minutes of data exchange analysis, 72.3% of applications can be identified. The accuracy of identifying new applications, which have not been encountered before, is 93.5%.
Source: opennet.ru
