AntMonitor

Abstract

We propose AntMonitor - a system for passive monitoring, collection and analysis of fine-grained, large-scale packet measurements from Android devices. AntMonitor is the first system of its kind that combines the following properties: (i) it provides participating users with fine-grained control of which data to contribute; (ii) it does not require administrative privileges; (iii) it supports client-side analysis of traffic; and (iv) it supports collection of large-scale, fine-grained, and semantic-rich traffic. The first three properties benefit mobile users, by giving them control over their privacy while also enabling a number of services to incentivize their participation. The last property makes AntMonitor a powerful tool for network researchers who want to collect and analyze large-scale, yet fine-grained mobile measurements. As a proof-of-concept, we have developed and deployed a prototype of AntMonitor, and we have used it to monitor 9 users for several months. AntMonitor has high network throughput while incurring lower CPU and battery costs than existing mobile monitoring systems. Our preliminary experience with the prototype demonstrates its capabilities and its potential for enabling several research activities, including network measurement from the edge, classification of mobile traffic, and detection of privacy leakage and other malicious behaviors.