Skip to content

What-App? App usage detection using encrypted LTE/5G traffic#

PETS 2026 digest Program Adjacent pick 20–25 July 2026

Recording

Authors: Jinjin WANG (University of Birmingham), Zishuai Cheng (Beijing University of Posts, Telecommunications), Mihai Ordean (University of Birmingham), Baojiang Cui (Beijing University of Posts, Telecommunications)

Play the recording: What-App? App usage detection using encrypted LTE/5G traffic

  • Why: Even with full payload encryption, the radio-access layer leaks enough (bearer patterns, QoS flows, timing) for a passive observer to classify which app is in use. For a PM with RAN and security background, this is the canonical "encryption is not traffic confidentiality" result, measured on modern 4G/5G.
  • What: Apparently a traffic-analysis attack that identifies applications from encrypted LTE/5G captures, demonstrating app-level fingerprinting despite payload and much metadata protection (title/author line only — no abstract in program).
  • How: Presumably supervised classification over radio-layer and flow features (bearer/QCI characteristics, timing, volume) rather than packet contents.
  • Where applicable: Threat model is the mobile network operator or an on-path observer with RAN visibility — relevant to zero-rating, lawful-intercept debates, and privacy claims of 5G (SUCI protects identity, not behavior).