Haystack: In Situ Mobile Traffic Analysis in User Space

Abstract

Despite our growing reliance on mobile phones for a wide range of daily tasks, we remain largely in the dark about the operation and performance of our devices, in-cluding how (or whether) they protect the information we entrust to them, and with whom they share it. The ab-sence of easy, device-local access to the traffic of our mo-bile phones presents a fundamental impediment to im-proving this state of affairs. To develop detailed visibil-ity, we devise Haystack, a system for unobtrusive and comprehensive monitoring of network communications on mobile phones, entirely from user-space. Haystack correlates disparate contextual information such as app identifiers and radio state with specific traffic flows des-tined to remote services, even if encrypted. Haystack fa-cilitates user-friendly, large-scale deployment of mobile traffic measurements and services to illuminate mobile app performance, privacy and security. We discuss the design of Haystack and demonstrate its feasibility with an implementation that provides 26–55 Mbps through-put with less than 5 % CPU overhead. Our system and results highlight the potential for client-side traffic anal-ysis to help understand the mobile ecosystem at scale. 1