Profiling of Secure Chat and Calling Apps from

Encrypted Traffic
M.A.K.Sudozai, Shahzad Saleem
School of Electrical Engineering and Computer Science
National University of Sciences and Technology
Islamabad, Pakistan
{asad.khan,shahzad.saleem}@seecs.edu.pk

Abstract—Increased use of secure chat and voice/ video apps stored contents (device forensics) [5] and (ii) study of network
has transformed the social life. While the benefits and facilitations traffic of these apps (network forensics) [6]. The study of
are seemingly limitless, so are the asscoiacted vulnerabilities network traffic of these apps can further be classified into
and threats. Besides ensuring confidentiality requirements for
common users, known facts of non-readable contents over the two different perspectives, (i) to find vulnerabilities in the
network make these apps more attractive for criminals. Though security architecture of these apps (ii) by carrying out the
access to contents of cryptograhically secure sessions is not behaviour analysis of traffic, find out fixed patterns which
possible, network forensics of secure apps can provide interesting lead to draw useful information about the users and identify
information which can be of great help during criminal invetiga- different events. Breaking cryptographic primitives is indeed
tions. In this paper, we presented a novel framework of profiling
the secure chat and voice/ video calling apps which can be a hard domain so as the underlying security protocols but
employed to extract hidden patterns about the app, information extensive studies of number of secure apps [7] have revealed
of involved parties, activities of chatting, voice/ video calls, status that quiet a useful information about the users and related
indications and notifications while having no information of events can still be extracted from these apps.
communication protocol of the app and its security architecture. In this paper, we presented a fundamental framework
Signatures of any secure app can be developed though our
framework and can become base of a large scale solution. Our comprising of number of techniques which can be used to
methodology is considered very important for different cases of profile the social media apps from their encrypted contents
criminal investigations and bussiness intelligence solutions for through extensive network traffic analysis. Our focus was
service provider networks. Our results are applicable to any not to highlight the vulnerabilities of cryptographic primitives
mobile platform of iOS, android and windows. used in different social media apps, rather we outlined the
Index Terms—Confidentiality, cryptography, chat and voice/ combination of techniques which can characterize their unique
video app, network forensic, iOS, android, windows. patterns based on which classification of different social media
apps can be made. Our results are based on study of traffic
I. I NTRODUCTION behaviour of client server communications of secure apps

T HE exponential use of secure chat and voice/ video call-

ing apps has emerged as an unprecedented phenomenon.
Remaining available anywhere, anytime and anyway through
which are not public in almost all the cases. Profiling of
secure social media apps based on our methodology can be
of great help for investigations involving use of these apps by
smart phones and mobile devices has added new dimensions to criminals/ targets. The demonstration of our results has also
social lives [1]. The confidentiality requirements of users has been carried out through minor events of Viber and IMO for
forced the designers of these apps to embed the strong security clarity of context.
architectures and proprietary communication protocols. Lately, The succeeding portion of this paper is organized as follows.
the concept of end-to-end encryption layers like Whatsapp [2] In Section II, we summarized the previous work done in
has provided apparent confidence to users that even servers forensics analysis of secure chat and voice/ video calling apps.
have no visibility to the exchanged contents. The increasing Section III discusses the complexity of traffic analysis and its
security strengths of social media apps seem very attractive classification techniques. Section IV discusses our proposed
on one side however, their extensive usage by criminals have methodology to profile the secure chat and voice/ video calling
raised serious concerns as well [3]. The level of criminal apps. The paper is finally concluded in Section V.
investigations becomes complex when secure social media
apps are involved because access to actual contents is not
II. R ELATED W ORK
possible from the encrypted network traffic. This aspect has
attracted research community of forensics and information With the advent of security in chat and calling apps, foresnic
security domains to carry out extensive study of secure social community has given more focus to analyze the secure apps.
media apps [4] and find out possible traces which can lead to Besides the confidentiality for public, security of contents and
extract maximum information. anonymity offered by these apps has always been exploited
The study of secure social media apps can broadly be by criminals. The reserach community therefore has given
categorized into two major dimensions, (i) study of on device consistent focus to analyze these secure apps and this field has
‹,(((
Authorized licensed use limited to: ULAKBIM-UASL - Abant Izzet Baysal Univ Library. Downloaded on November 18,2023 at7HFKQRORJ\
3URFHHGLQJVRIWK,QWHUQDWLRQDO%KXUEDQ&RQIHUHQFHRQ$SSOLHG6FLHQFHV 17:34:03 UTC from 
IEEE Xplore. Restrictions
,%&$67 apply.
,VODPDEDG3DNLVWDQWK±WK-DQXDU\
 duly bridged the gaps between academia and law enforcement Our methodology of traffic analysis is considered novel
agencies over a decade or so [8]. The digital forensics thus because we presented the concept of stydying secure chat and
became most important component of any crime investigation calling apps and their connectivity protocols in a controlled
in technological era [9], [10], [7]. For both the dimensions of environment by employing the hardware firewall to force the
forensics, [4] presented the deep analysis for both scenarios client app to connect to its servers using all available options.
of device storage and network forensics of 20 famous social Hidden pattrens of communication protocols of number of
media apps. For network analysis part, focus was on recon- secure apps were explored which otherwise remain obscure in
struction of traffic through that part of network traffic which is normal connectivity scenerios. Though the exchanged contents
observed as plain while encrypted traffic is discarded and not are encrypted over the network, identification of secure apps
analyzed. The analysis carried out in this paper was restricted and classification of their events is made through behaviour
to Android only, however [11], [12] discussed the forensics analysis of encrypted packets. Based on our analysis of number
results of secure apps for Blackberry and iOS as well. of secure chat and calling apps, a comprehensive framework
The focus of network forensics of secure apps is actu- is proposed which can facilitate to identify user activities. Our
ally the exntensive traffic analysis of encrypted contents. methodology can be applied to any OS of mobile platform and
With no knowledge of communication protocol and security coupled with research on IPv6 scanning [25], our techniques
architecture, useful information extraction has always been of behavioural analysis of encrypted packets are considered
challenging. A comprehensive account of traffic classification valid for IPv6 internet environment as well.
and challenges which effect the correct identification of apps
and their events was summarized in [13]. Skype being the III. T RAFFIC C LASSIFICATION OF C HAT AND C ALLING
leading secure app attained the most focus and number of A PPS - A C OMPLEX PARADIGM
vulnerabilities were highlighted related to its protocol and
security architecture [14], [15]. Similarly, specific forensic We discussed the ideology of traffic classification of secure
studies have been carried out on other individual secure apps social media apps in this Section which is based on many un-
but device forensic hosting these apps was primarily the derlying factors. As the calling and instant messaging mobile
focus and very little has been done on network forensics of apps use variety of protocols for video, voice, chat and file
individual secure apps. [16] covered the ChatSecure, [17] sharing services based on classical server client architecture,
discussed the forensic study of WeChat and [18], [19], [20] study of different baseline protocols and their pecularities used
are few of the noteable accounts of studies carried out on in mobile platforms is very essential to detect and classify the
WhatsApp. apps from traffic analysis. The general understanding prevails
The techniques of network forensics of secure apps are that services of server client communication, text chats and
mostly limited to observed traffic over the network and classi- file sharing are normally running on TCP and voice/ video
fication is mostly done on the basis of tracking IP flows, TCP/ is provided on UDP. Within these major protocols, variety
UDP ports, server and client port fixations while very little is of implementation flexibilities exist which make the traffic
published on the behavioural analysis of Secure apps. [21], behaviour of any calling/ chat social media app different from
[22] presented their results of Viber including the network others. To provide the services of voice, video and chat by any
traffic analysis but their results are no more valid for securer social media VoIP app which incorporates the cryptographic
versions of Viber. Since 2015, Viber has undergone major security, design of any app includes:
shift in its security architecture by incorporating Openwhisper 1) Text chat threads.
based strong cryptographic base [23]. Our recent work on net- 2) Voice call.
work forensics of Viber highlighted fixed patterns in encrypted 3) Video call.
traffic which could lead to identify different events of Viber 4) Media file sharing requiring compression to reduce size.
including chat messages, voice/ video calls, notifications and 5) Signalling.
file sharing [24]. 6) Confidentiality and integrity.
In this work, we presented a generic methodology of 7) Key establishment.
profiling any secure chat and voice/ video calling app from 8) Update methodology.
network traffic. Our focus was not to target vulnerabilities of 9) Methodology for status indicators/ notifications.
cryptographic functions, neither we discarded encrypted traffic 10) User authentication mechanism.
altogather. By intercepting the encrypted traffic flows between 11) Secure on-device storage.
servers and their secure app clients, we tried to draw possible For each of these items, number of options exist for designer
traces of correlation of different events through behavioural of chat and video/ voice apps which if considered during
analysis of SSL encapsulated packets. We consider our work the traffic analysis can be of advantage to characterize the
different from existing research on network forensic of secure particular app and its behaviour. For instance, IMO chat is
apps because we performed deep inspection of encrypted using XMPP [26], [27], while Whatsapp is assumed to be
traffic of number of secure apps and followed their flows in using customized XMPP protocol for chat texts. Decision
a totally adaptive environment against the simulated events of making for identification of the apps from network traffic
chat messages, voice calls, video calls, switch over between dumps would be based on different paremeters because of
voice and video, scenerios of file sharing and number of XMPP and its customized implementation. Similarly Signal
notification messages. [28] is using Google Cloud Messaging (GCM) [29] protocol
3URFHHGLQJVRIWK,QWHUQDWLRQDO%KXUEDQ&RQIHUHQFHRQ$SSOLHG6FLHQFHV 7HFKQRORJ\ ,%&$67  
Authorized licensed use limited to: ULAKBIM-UASL - Abant Izzet Baysal Univ Library. Downloaded on November 18,2023 at 17:34:03 UTC from IEEE Xplore. Restrictions apply.
,VODPDEDG3DNLVWDQWK±WK-DQXDU\
 but its usage with CopperheadOS [30] does not depend on
GCM. In these scenerios, traffic behaviour of Signal would be
entirely different for varying platforms.
To eleborate further, let us also analyze the case of voice
or video calling implementation scenerios. The most common
protocol being used is RTP with its secure version i.e. SRTP
as WhatsApp is using it for both voice and video calls.
However, implementation of this service may vary from design
to desig like Signal app is using LibJingle for P2P connectivity.
Another dimension, which adds complexity to traffic analysis
of chat and voice/ video call apps, is their desktop versions. Fig. 1. Traffic Sniffing Setup
Variety of implementation options exist to achieve compata-
bility of desktop/ web versions with their mobile platform
versions. Skype, for example is using webRTC [31] which out on number of secure chat and calling mobile apps. The
facilitates web browsers to support voice and video chat and methdology can be extended to any OS of mobile platform like
peer-to-peer connections. Furthermore, baseline OS platforms iOS, Android and windows or their securer variants and can be
contribute a lot to impose peculiar limitations on the designers used in different combinations to derive important results. Our
of apps to follow particular set of rules of compatability. traffic analysis scenerio can be built in any small scale network
During the study of number of secure chat and calling apps, lab and based on these results, a deployable solution of
we observed that traffic flows of a particulat app on an Android profiling secure social media apps can be developed to classify
OS are quiet different to that of iOS and Windows platforms. the network traffic of intent. We tried to summarize our
These multiple options of design implementations coupled findings in discrete steps; however analysis of any particular
with non readable contents over the network (encrypted traffic) app will require different combination of these techniques
make the traffic analysis of mesaging and calling apps a applicable to the peculair design and traffic behaviour of the
challenging area. In next Section, a framework is presented app.
which if implemented in different combinations can extract
information of any secure app from network traffic without A. Setting up the Experimental Setup for Traffic Classification
knowing the details of hidden communication protocol and
We start with description of experimental setup which is first
layers of security architecture.
brick in the foundation of traffic analysis. As we need to profile
a chat or calling secure app, our first requirement is to have an
IV. P ROPOSED F RAMEWORK OF T RAFFIC C LASSIFICATION access to the traffic originated from the mobile phone hosting
OF C HAT / C ALLING A PPS the client of the app. We establish the network as shown
Information on the networks can be guarded through num- in Figure 1. A wireless acccces point/router is connected to
ber of techniques. Generally, encryption is assumed to provide the Layer 3 switch with internet connectivity terminated on
both the desireables of obfuscation and confidentiality over one of the ports as shown. The target mobile is connected
the internet. It is very important to notify that encryption to the wireless router and a mirroring port of the switch is
alone does not mean that something over the network is configured to collect the entire traffic of the port to which the
undetectable or unidentifiable. As encryption mostly relies on wireless router was connected. The data of mirroring port is
TLS or IPSEC over the internet, their detection is even possible then fed to our protocol analyzer module to analyze the traffic
through commonly available traffic/ protocol analyzers like of the mobile. Any commonly available traffic analyzer like
Wireshark. Along with encryption, obfuscation measures are Wireshark can be used to sniff and analyze the traffic entering
widely employed to avoid identification and detection through in or exiting out from the mobile device. Traffic dumps must
traffic analysis and to reduce the efficacy of simple pattern be saved as pcap-files for detailed analysis during the study
recognition algorithms. In this scenerio of profiling secure for building correlations, where necessary.
apps and extract maximum possible information from available
network traffic, let us list the extents of our problem domain B. Traffic Control Policy Implementation
before we present our methodology: After the successful traffic capturing, it is usually observed
1) The communication protocol of the target app is not that lot of traffic is originated from mobile device including
known. OS related backups, different updates, notifications etc. The
2) Communication between the target app client to its first step would be to identify the connections of target app
servers is encrypted. client to its servers. Initiation of sessions by opening and
3) The security architecture is not public. closing/ stopping the app on mobile device and their sync with
4) Only access to overall network traffic is available. packet captures through traffic analyzer can be correlated to
5) Underlying platforms and used protocols are not known. define connection estabishment with the target app servers.
With these limitations in focus, we discuss the step wise One can generally trigger repeated events of messaging, voice
methodology of profiling a particular app. Our proposed and video calls or file sharing to analyze the traffic captures
technique is outcome of extensive research which we carried against these events but this would be a very basic level
3URFHHGLQJVRIWK,QWHUQDWLRQDO%KXUEDQ&RQIHUHQFHRQ$SSOLHG6FLHQFHV 7HFKQRORJ\ ,%&$67  
Authorized licensed use limited to: ULAKBIM-UASL - Abant Izzet Baysal Univ Library. Downloaded on November 18,2023 at 17:34:03 UTC from IEEE Xplore. Restrictions apply.
,VODPDEDG3DNLVWDQWK±WK-DQXDU\
 analysis. Normally, the designers of chat and calling apps keep in Table I for elaboration. This methodology forces the target
flexibilities of connectivity between servers and their clients app to switch over to all possible designs of connectivity. Our
distributed geographically around the globe and number of novel technique of using firewall in network forensic study
alternate mechanisms are embedded in their designs to ensure of secure apps has proven to be very useful method to reveal
obfuscation. For instance, a client establishing the connection hidden patterns of designs which are normally implemented
to its server may be observed to use 2 to 3 fixed TCP ports. It to bypass the network policy management.
is very likely that developers of app have kept more range of
TCP ports for server-client connectivity and their prioritization C. Identification of Server Ranges
is designed on few other parameters/ scenerios. Behaviour
Any secure chat or calling app has to use SSL/ TLS
analysis through traffic captures is always a very probabilistic
layer [32] to achieve intended requirements of security. A
model and decision making may involve questionable ratio of
secure app client is always designed to initiate connections
false positives.
with its servers geographically located in that region or central
After carrying out extensive study of secure apps, we
servers located in the host country. Triggering the events of
propose a noval technique of network forensics of secure apps
connections from target app to its servers, server ranges can
which is aimed to establish reliable model of decision making
be determined. Using the firewall, subnets of server ranges can
through traffic analysis. To implement strict traffic control
be blocked to force the target app to try connnections on all
policy for network forensic experimmental setup, a hardware
available options embedded in its design. Secure apps using
firewall as shown in Figure 1 ensures to analyze the traffic
the cloud services can also be tested through this mechanism to
in a purely controlled environment. Through controls on the
switch over to alternate options. During our research, number
firewall, client to server connectivity and even peer to peer
of apps were observed which maintained parallel session with
scenerios can be forced to shift to alternates avilable in the
their servers of different ranges while using any one of the
designs.
connection as primary. Determining the server ranges for any
Now, we consider a case study of profiling Viber voice call
app is thus fundamental step to profile a secure chat/calling
and demonstrate the usability of firewall in the traffic sniffing
app.
environment for Viber app. Our initial captures of voice call
Another important aspect in this case is that apps host
showed that Viber client established the connection to it’s
different servers for maintaining chat and voice/video services
server on destination UDP port of 7985 as shown in Figure 2.
separately and this may vary from app to app. This leads to
further analyze the traffic flows between client and different
servers and identify different patterns of services. Geograph-
ical location of analysis setup is also important to consider
while maintaining complete profile of few apps. For instance,
cluster of Viber servers is hetereoneously scattered around the
world and ranges may vary according to the locations [22].
Similarly, new design of Skype incorporates phenomenon of
shifting traffic loads from servers to few of the users declared
as super nodes which are having better bandwidth available
with them [33].
Fig. 2. Viber Connection on Server UDP port 7985

After observing repeated connections on UDP port 7985, D. Identification of User IPs in Peer to Peer Scenerio
we imposed restrictions on UDP port 7985 through firewall. A very important finding of traffic analysis of chat and
This rule on firewall forced the viber server-client connectivity calling apps is determination of involved parties through their
mechanism to shift to alternate ports kept in the deisgn. We IPs. Knowing the server ranges of a particular app as discussed
observed that the Viber client established the connection with in Section IV-C, one can identify one user atleast from tarffic
its server on new destination UDP port of 7987 now as shown analysis activity. Let we re-consider the case study of profiling
in Figure 3. Through this method, we verified that viber Viber voice call as discussed in Section IV-B, it is evident
from Figure 2 that IP of one user is clearly identifiable. For
voice/ video calls, it was observed that multiple sessions are
attempted from server to client in parallel to get the traffic off-
Fig. 3. Viber Connection on Server UDP port 7987 loaded from servers. This feature seems logical for facilitating
real time processing, however P2P connections are attempted
establishes the voice calls on UDP ports of 7985, 7987 , 5243 depending upon few conditions of bandwidth capacity of the
and 9785. client. This phenemenon is very common in many of the secure
Step wise triggering the events like messaging, voice calls, chat and voice/ video calling apps. During the study of their
video calls, group activities and file sharing followed by traffic dumps, IPs of both the calling and caller parties can be
recording the progressive flow of observations can help to identifed. This can be a very critical finding for any criminal
define the firewall rule sets. The progressive flow of firewall investigation where both the involved parties are identified.
rule sets in relation to Viber traffic sniffing scenerio is outlined For our case study of Viber voice call, Figure 4 demonstrates
3URFHHGLQJVRIWK,QWHUQDWLRQDO%KXUEDQ&RQIHUHQFHRQ$SSOLHG6FLHQFHV 7HFKQRORJ\ ,%&$67  
Authorized licensed use limited to: ULAKBIM-UASL - Abant Izzet Baysal Univ Library. Downloaded on November 18,2023 at 17:34:03 UTC from IEEE Xplore. Restrictions apply.
,VODPDEDG3DNLVWDQWK±WK-DQXDU\
 Step Protocol Source Port Dest Port Action Observation
I Any Any Any Any Server UDP port connections on 7985
II UDP 7985 Any Block
UDP Any 7985 Block UDP port connections on 7987
III UDP 7985, 7987 Any Block
UDP Any 7985, 7987 Block UDP port connection on 5243
IV UDP 7985, 7987, 5243 Any Block
UDP Any 7985, 7987,5243 Block UDP port connection on 9785
V UDP 7985, 7987, 5243, 9785 Any Block
UDP Any 7985, 7987, 5243, 9785 Block UDP connection failed

TABLE I
P ROGRESSIVE FIREWALL RULE SETS FOR V IBER

the multiple P2P connectins which were attempted by Viber

client.

Fig. 5. IMO - Connection on TCP port 5228

Fig. 4. Viber - P2P connection requests

F. Traffic Behaviour Analysis

Server ranges and source/ destination ports determined
E. Identification of Source and Destination Ports
through controlled policy enforcement managed via firewall
Coupled with server ranges and user IPs, determining source easily segregate the traffic of target app from network traffic.
and destination TCP or UDP ports is very important. In some Next step is to identify different events of user activities of
scenerios of peer to peer connectivity, assigned ports to clients chat, call and file sharing. Moreover, trend of status sharing
do not change through out the established sessions and thus and different notifications is also very common in almost all
become the base of analysis. Profiling secure chat/ calling the chat and calling apps. However, identification of all these
apps though server ranges and TCP/ UDP ports is known in events from network traffic is very difficult in a scenerio when
literature for years [34]. However, use of firewall to determine all the contents are encrypted and detail of communication
all possible ports being used by an app is very innteresting protocol and security architecture are not known. Extensive
and brings new dimension of analysis. For instance, one may behaviour analysis conducted on traffic dumps of chat, calling
declare through results of initial sessions that a secure chat app and notification events etc. can help to identify these events.
is using XMPP (Extensible Messaging and Presence Protocol) Before the study of traffic dumps against the events, it is
which communicates on standard TCP ports of 5222 and 5223 important to list possible events which are applicable to most
(XMPP over SSL) [35]. Blocking these ports on firewall will of the secure chat and voice/calling apps. For clarity of context,
highlight hidden design flexibilities which may become base we list few of the possible events against which traffic must
to draw more inferences about the obsfucation techniques be captured and analyzed to profile a secure chat and calling
employed in the design of the app. Let we explain this fact app.
through one of the scenerio of our another case study in 1) User opens up the app.
which IMO Chat events were being profiled. Initially, it was 2) User opens up the chat thread.
observed that IMO established connections on TCP ports of 3) User starts writing and indication is appeared on chat
5222 and 5223. Once we blocked these ports on firewall, study screen of other user.
of dumps of IMO client-server chat communication revealed 4) User is shown off-line/ online.
that IMO client app then switched over to TCP port of 5228 5) User A sends the message to user B.
for establishing the connection with its servers as shown in 6) User B reads the message.
Figure 5. 7) Message is transmitted by User A but User B is off-line.
Drilling in the flexibility of usable ports by a secure 8) Message is delivered to User B who did not read it.
app also facilitates to determine used protocols for diferent 9) In some apps, self destruction mechanism is imple-
services. However, the trend of protocol obfuscation by using mented according to set time. In this case, messages
randomized ports has increased manifolds over the recent are exchanged for self destruction actions.
years due to deployment of monitoring and blocking solutions 10) Call initiated from User A.
by government agencies. In this situation, randomized ports 11) Call initiated from User B.
used by secure chat and calling apps hinder their absolute 12) Group messaging scenerios.
identification from network traffic. Therefore, profiling of such 13) Voice calls.
secure apps requires deep inspection of traffic patterns being 14) Video calls.
exchanged between the servers and their clients. 15) Voice call is converted to video call and vise-versa.
3URFHHGLQJVRIWK,QWHUQDWLRQDO%KXUEDQ&RQIHUHQFHRQ$SSOLHG6FLHQFHV 7HFKQRORJ\ ,%&$67  
Authorized licensed use limited to: ULAKBIM-UASL - Abant Izzet Baysal Univ Library. Downloaded on November 18,2023 at 17:34:03 UTC from IEEE Xplore. Restrictions apply.
,VODPDEDG3DNLVWDQWK±WK-DQXDU\
 Fig. 6. Framework of profiling secure chat/ calling app

16) File sharing scenerio of different sizes, for example from server to client and from client to server for
images of different sizes, voice and video transmissions. different events. The fixed ports, if maintained during the
17) User closes the app. sessions, can be utilized to extract reliable information
After listing the possible events against different services through filtering the traffic flows.
offered by secure chat and voice/ video calling apps, one must The complete framework of profiling a secure chat/ calling
trigger each of the event in a controlled setup as described mobile app is depicted in a flow diagram as shown in Figure 6.
in Section IV-B and analyze the traffic behaviour. To carry Starting from traffic capture after accessing the app, deter-
out this extensive work of deep traffic analysis and point out mining server ranges is done through employment of strict
fixed patterns, many techniques are applied as a standalone policy control mechanism. This is then followed by source
or in combination with others depending upon the observed and destination ports identification for chat and call events
patterns of the target app. Starting with observing the general again in a adaptive firewall environment. Analysis of peer to
patterns of traffic flows, increased reliability and accuracy can peer connections and their used ports can lead to information
be achieved by carrying out behaviour analysis of exchanged about the caller and calling parties. Finally, the number of
bytes in consonance to triggered events. Based on our research events of chat and calling services including their notifications
on number of secure chat and voice/ video calling apps, few of can be profiled by carrying out the extensive traffic behaviour
the techniques are listed which can be employed in number of analysis.
different combinations depending upon the designs of target Let we correlate the typical case scenerio of WhatsApp
apps: with our framework of profiling it while the app provides end
1) Inspection of byte patterns is carried out by repeating to end encryption features over the network. Based on our
the forced events in a firewalled controlled scenerio. methodolgy, detection of WhatsApp traffic over the network
2) Frequency of bytes exchanged for different events. is possible due to step-wise determination of WhatsApp server
3) Acks and responses between server and client. ranges, identification of IPs of possible cases of P2P and
4) Payload sizes for different services and their uniqueness finding out the UDP ports used during the voice/ video
with respect to different events. calls. Further classification of activities of a WhatsApp user
5) Tracking/ monitoring the state changes within control can be established through intense behaviour analysis of
and data traffic for different triggered events to extract encrypted traffic. Against the possible events of WhatsApp
useful information which can leas to correct identifica- like chat, voice messages, voice calls, video calls, media and
tion of a particular event. file sharings, user status notifications including online and
6) Duration of voice and video calls vs bytes being ex- last seen, message delivered and message read, group mes-
changed with their sizes and frequency measurements. sages and their status, message deletion activities and location
7) Byte patterns during the events of shifting from voice sharing, complete signatures of WhatsApp can be developed.
to video or vise-versa and typing and sending the text Comprehensive account of our results on profiling WhatsApp
during the call. and IMO calling and chat applications are being published
8) Counts of events for each triggered service. separately. However, partial demonstration of application of
9) Following the flows of traffic through protocol analyzers these techniques without the context of control policy enforced
3URFHHGLQJVRIWK,QWHUQDWLRQDO%KXUEDQ&RQIHUHQFHRQ$SSOLHG6FLHQFHV 7HFKQRORJ\ ,%&$67  
Authorized licensed use limited to: ULAKBIM-UASL - Abant Izzet Baysal Univ Library. Downloaded on November 18,2023 at 17:34:03 UTC from IEEE Xplore. Restrictions apply.
,VODPDEDG3DNLVWDQWK±WK-DQXDU\
 by firewall can be found in [24]. [11] N. Al Mutawa, I. Baggili, and A. Marrington, “Forensic analysis of
As each app has its peculiar design and underlying platform social networking applications on mobile devices,” Digital Investigation,
vol. 9, pp. S24–S33, 2012.
with varied protocols used, the proposed methodology can be [12] Y.-C. Tso, S.-J. Wang, C.-T. Huang, and W.-J. Wang, “iphone social
employed to develop large scale solution to identify the events networking for evidence investigations using itunes forensics,” in Pro-
and their respective apps on variety of network monitoring ceedings of the 6th International Conference on Ubiquitous Information
Management and Communication. ACM, 2012, p. 62.
scenerios. Moreover, solutions of bussiness intelligence can [13] A. Dainotti, A. Pescape, and K. C. Claffy, “Issues and future directions
also utilize our methodology to get hueristics of different apps in traffic classification,” IEEE network, vol. 26, no. 1, pp. 35–40, 2012.
and improve the efficiency of their deployed solutions in terms [14] B. Dupasquier, S. Burschka, K. McLaughlin, and S. Sezer, “Analysis of
information leakage from encrypted skype conversations,” International
of network performance and optimizations. Journal of Information Security, vol. 9, no. 5, pp. 313–325, 2010.
[15] S. Molnár and M. Perényi, “On the identification and analysis of skype
traffic,” International Journal of communication systems, vol. 24, no. 1,
V. C ONCLUSION pp. 94–117, 2011.
In this paper, we presented a framework of profiling the [16] C. Anglano, M. Canonico, and M. Guazzone, “Forensic analysis of
the chatsecure instant messaging application on android smartphones,”
secure chat and calling apps from encrypted contents which is Digital Investigation, vol. 19, pp. 44–59, 2016.
considered a facet of network forensics. Our methodology of [17] S. Wu, Y. Zhang, X. Wang, X. Xiong, and L. Du, “Forensic analysis of
employing firewall in traffic sniffing and analysis applications wechat on android smartphones,” Digital Investigation, vol. 21, pp. 3 –
10, 2017.
conducts different experiments in a controlled environment [18] C. Anglano, “Forensic analysis of whatsapp messenger on android
and forces the client of target app to try all options of smartphones,” Digital Investigation, vol. 11, no. 3, pp. 201–213, 2014.
connectivity with its servers. In this way, one can identify the [19] F. Karpisek, I. Baggili, and F. Breitinger, “Whatsapp network forensics:
Decrypting and understanding the whatsapp call signaling messages,”
hidden patterns of communication protocol and extract useful Digital Investigation, vol. 15, pp. 110–118, 2015.
information about users and their activities. Starting from [20] A. Majeed, H. Zia, R. Imran, and S. Saleem, “Forensic analysis of three
correct detection of target app from encrypted network traffic, social media apps in windows 10,” in High-Capacity Optical Networks
and Enabling/Emerging Technologies (HONET), 2015 12th International
our results of traffic behaviour classify different activities of Conference on. IEEE, 2015, pp. 1–5.
the users like messaging, stauts identifications, notifications, [21] M. Appelman, J. Bosma, and G. Veerman, “Viber communication
file sharing ,voice and video calls. It is important to note security,” System and network of engineering, university of Amsterdam,
Netherlands, 2011.
that our proposed techniques may be used in any combination [22] R. Marik, P. Bezpalec, J. Kucerak, and L. Kencl, “Revealing viber
depending upon the design of the target app and its security communication patterns to assess protocol vulnerability,” in 2015 In-
architecture. Solutions at large scale can be developed to ternational Conference on Computing and Network Communications
(CoCoNet). IEEE, 2015, pp. 496–504.
embed signatures of different apps and can be utilized in [23] I. Rakuten, “Viber Encryption Overview,”
criminal investigations and bussiness itelligence solutions for http://www.viber.com/en/security-overview, 1997 (accessed 30-August-
networks. It is important to note that our methodology is 2016).
[24] M. Sudozai, N. Habib, S. Saleem, and A. Khan, “Signatures of viber
not only applicable to chat and voice/ video calling apps but security traffic,” Journal of Digital Forensics, Security and Law, vol. 12,
can be generalized to other social media applications with no. 2, p. 11, 2017.
slight variations for any mobile platform of Android, iOS and [25] O. Gasser, Q. Scheitle, S. Gebhard, and G. Carle, “Scanning
the ipv6 internet: towards a comprehensive hitlist,” arXiv preprint
windows. arXiv:1607.05179, 2016.
[26] P. Saint-Andre, K. Smith, and R. Tronçon, XMPP: the definitive guide.
R EFERENCES ” O’Reilly Media, Inc.”, 2009.
[27] A. Hornsby and R. Walsh, “From instant messaging to cloud computing,
[1] T. Barot and E. Oren, “Guide to chat apps,” Tow Center for Digital an xmpp review,” in Consumer Electronics (ISCE), 2010 IEEE 14th
Journalism, 2015. International Symposium on. IEEE, 2010, pp. 1–6.
[2] M. S. Melara, A. Blankstein, J. Bonneau, E. W. Felten, and M. J. [28] K. Cohn-Gordon, C. Cremers, B. Dowling, L. Garratt, and D. Stebila, “A
Freedman, “Coniks: Bringing key transparency to end users.” in USENIX formal security analysis of the signal messaging protocol,” in Security
Security Symposium, 2015, pp. 383–398. and Privacy (EuroS&P), 2017 IEEE European Symposium on. IEEE,
[3] T. B. Tan, “Rebalancing encrypted messaging apps,” 2016. 2017, pp. 451–466.
[4] D. Walnycky, I. Baggili, A. Marrington, J. Moore, and F. Breitinger, [29] Y. S. Yilmaz, B. I. Aydin, and M. Demirbas, “Google cloud messaging
“Network and device forensic analysis of android social-messaging (gcm): An evaluation,” in Global Communications Conference (GLOBE-
applications,” Digital Investigation, vol. 14, pp. S77–S84, 2015. COM), 2014 IEEE. IEEE, 2014, pp. 2807–2812.
[5] F. Norouzizadeh Dezfouli, A. Dehghantanha, B. Eterovic-Soric, and K.- [30] Y. Yang, J. Zhang, and T. Wang, “How to make android updating
K. R. Choo, “Investigating social networking applications on smart- securer?: A new android updating model,” in Proceedings of the 2016
phones detecting facebook, twitter, linkedin and google+ artefacts on International Conference on Communication and Information Systems.
android and ios platforms,” Australian journal of forensic sciences, ACM, 2016, pp. 69–72.
vol. 48, no. 4, pp. 469–488, 2016. [31] C. Vogt, M. J. Werner, and T. C. Schmidt, “Leveraging webrtc for p2p
[6] T. V. Lillard, Digital forensics for network, Internet, and cloud comput- content distribution in web browsers,” in Network Protocols (ICNP),
ing: a forensic evidence guide for moving targets and data. Syngress 2013 21st IEEE International Conference on. IEEE, 2013, pp. 1–2.
Publishing, 2010. [32] E. Rescorla, SSL and TLS: designing and building secure systems.
[7] J. Brunty, L. Miller, and K. Helenek, Social media investigation for law Addison-Wesley Reading, 2001, vol. 1.
enforcement. Routledge, 2014. [33] S. C. Landers and M. D. Doyle, “Automated communications response
[8] R. W. Taylor, E. J. Fritsch, and J. Liederbach, Digital crime and digital system,” Aug. 4 2015, uS Patent 9,100,465.
terrorism. Prentice Hall Press, 2014. [34] A. Callado, C. Kamienski, G. Szabó, B. P. Gero, J. Kelner, S. Fernan-
[9] K. C. Seigfried-Spellar and S. C. Leshney, “The intersection between so- des, and D. Sadok, “A survey on internet traffic identification,” IEEE
cial media, crime, and digital forensics:# whodunit?” Digital Forensics: communications surveys & tutorials, vol. 11, no. 3, 2009.
Threatscape and Best Practices, p. 59, 2015. [35] GitHub, “XMPP — Instant Messaging,” https://xmpp.org/uses/instant-
[10] M. Huber, M. Mulazzani, M. Leithner, S. Schrittwieser, G. Wondracek, messaging.html, 2017 [accessed 3-june-2017].
and E. Weippl, “Social snapshots: Digital forensics for online social
networks,” in Proceedings of the 27th annual computer security appli-
cations conference. ACM, 2011, pp. 113–122.

3URFHHGLQJVRIWK,QWHUQDWLRQDO%KXUEDQ&RQIHUHQFHRQ$SSOLHG6FLHQFHV 7HFKQRORJ\ ,%&$67  

Authorized licensed use limited to: ULAKBIM-UASL - Abant Izzet Baysal Univ Library. Downloaded on November 18,2023 at 17:34:03 UTC from IEEE Xplore. Restrictions apply.
,VODPDEDG3DNLVWDQWK±WK-DQXDU\