Search arXiv⌕ Search
Home/Archive/arXiv

arXiv · 2407.07361

Characterizing Encrypted Application Traffic through Cellular Radio Interface Protocol

Md Ruman Islam·Raja Hasnain Anwar·Spyridon Mastorakis·Muhammad Taqi Raza
View original source ↗Read source document ↗Export metadata ↓

Abstract

Modern applications are end-to-end encrypted to prevent data from being read or secretly modified. 5G tech nology provides ubiquitous access to these applications without compromising the application-specific performance and latency goals. In this paper, we empirically demonstrate that 5G radio communication becomes the side channel to precisely infer the user's applications in real-time. The key idea lies in observing the 5G physical and MAC layer interactions over time that reveal the application's behavior. The MAC layer receives the data from the application and requests the network to assign the radio resource blocks. The network assigns the radio resources as per application requirements, such as priority, Quality of Service (QoS) needs, amount of data to be transmitted, and buffer size. The adversary can passively observe the radio resources to fingerprint the applications. We empirically demonstrate this attack by considering four different categories of applications: online shopping, voice/video conferencing, video streaming, and Over-The-Top (OTT) media platforms. Finally, we have also demonstrated that an attacker can differentiate various types of applications in real-time within each category.

Explore related subjects

cs.NIcs.CRcs.LG

Keep this discovery

Explore connections, maps & timelines

BibTeXRIS

Md Ruman Islam, Raja Hasnain Anwar, Spyridon Mastorakis, Muhammad Taqi Raza. 2024-07-20. Characterizing Encrypted Application Traffic through Cellular Radio Interface Protocol. https://arxiv.org/abs/2407.07361

Cite the original work for its findings. Save a collection to share your selection of sources.

KEEP EXPLORING

Related papers

arXiv2026

Secure Polarization-Shift Backscatter Identification Applied to Battery-Free BLE Sensors Powered by Wireless Power Transfer

This paper presents a lightweight and protocolindependent security mechanism for battery-free Bluetooth Low Energy (BLE) sensor nodes operating in Simultaneous Wireless Information and Power Transfer (SWIPT) architecture. The proposed approach exploits polarization-shift backscattering of the wireless power wave to transmit an encrypted device identification prior to data communication. A fail-safe RF switch and orthogonally polarized antennas are integrated as an external add-on module, enabling controlled backscatter without modifying the original energy-harvesting rectifier. The identification payload is encrypted using AES-128 and transmitted with minimal energy overhead. Experimental validation on a battery-free BLE sensor node demonstrates reliable extraction of the backscattered identification signal, seamless coexistence with BLE advertising, and improved RF-to-DC harvesting efficiency compared to rectifier-based backscatter solutions. The results confirm that polarization-shift backscatter identification provides an effective and practical security for battery-free BLE sensing systems.

cs.NI↗
arXiv2026

From WPT to Encrypted Telemetry: A Battery-Free Backscattering-based Polarimetric Wireless Sensor

This work introduces an indoor Battery-Free Wireless Sensing Node powered through radiative Wireless Power Transfer (WPT). The proposed platform targets secure, energyefficient active sensing and overcomes key limitations of many prior battery-free approaches, which commonly provide neither on-node computation nor cryptographic protection. The node combines temperature, humidity, pressure and Volatile Organic Compound (VOC) measurements with a low-power microcontroller that executes sensor calibration, derives a VOC index, formats the payload, and applies AES-128 encryption before wireless transmission. Energy harvesting and communication are enabled by a 1-bit controlled Backscatter Rectenna (BR), which both scavenges incident RF power and produces an orthogonally polarized backscattered signal for robust polarimetric operation. Experimental results validate reliable multi-sensor readout and encrypted data transfer, while maintaining a very low energy budget for the complete sense-compute-encrypt-transmit cycle.

cs.NI↗
arXiv2026

NebulaSD: Many-for-Many Speculative Decoding

Speculative decoding accelerates Large Language Model (LLM) inference by using a lightweight draft model to propose candidate tokens for parallel verification by a target model. Drafting and verification, however, exhibit different service characteristics and favor different batch configurations, making fixed draft-target coupling inefficient under concurrent workloads. Existing distributed designs can physically separate the two stages, but often retain request or batch affinities that prevent their capacities from being shared globally. We present NebulaSD, a many-for-many, or M-for-N, speculative decoding system that organizes draft and target workers into independently schedulable resource pools and dynamically reconstructs stage-specific batches from shared request pools. Such dynamic reassignment removes fixed worker locality, requiring request states to be made available at newly selected workers without introducing migration stalls. NebulaSD addresses this challenge through worker-triggered batch reconstruction and asynchronous KV-state preparation overlapped with model execution. We evaluate NebulaSD from both system and scaling perspectives, showing that dynamic pooling improves request-round processing rate by 50.4% over a physically disaggregated baseline and 72.6% over co-located execution on a four-GPU deployment while substantially increasing effective GPU utilization. Profile-driven simulations further show approximately proportional compute-side capacity scaling under idealized state movement.

cs.NI↗