Mobile Traffic Classification through Physical Channel Fingerprinting: a Deep Learning Approach

TL;DR

This paper presents a deep learning-based method for classifying mobile applications and services by analyzing physical channel fingerprints from LTE networks, achieving high accuracy without decrypting data.

Contribution

It introduces a CNN-based classifier that uses DCI messages for application identification and incorporates session rejection for online traffic decomposition.

Findings

CNN classifier achieves 99% accuracy

Effective online and unsupervised traffic decomposition

Utilizes physical channel features without data decryption

Abstract

The automatic classification of applications and services is an invaluable feature for new generation mobile networks. Here, we propose and validate algorithms to perform this task, at runtime, from the raw physical channel of an operative mobile network, without having to decode and/or decrypt the transmitted flows. Towards this, we decode Downlink Control Information (DCI) messages carried within the LTE Physical Downlink Control CHannel (PDCCH). DCI messages are sent by the radio cell in clear text and, in this paper, are utilized to classify the applications and services executed at the connected mobile terminals. Two datasets are collected through a large measurement campaign: one labeled, used to train the classification algorithms, and one unlabeled, collected from four radio cells in the metropolitan area of Barcelona, in Spain. Among other approaches, our Convolutional Neural Network (CNN) classifier provides the highest classification accuracy of 99%. The CNN classifier is then augmented with the capability of rejecting sessions whose patterns do not conform to those learned during the training phase, and is subsequently utilized to attain a fine grained decomposition of the traffic for the four monitored radio cells, in an online and unsupervised fashion.