Identifying Synchronous and Asynchronous Communications in IMA Traffic

Instant messaging applications (IMAs) rely on message encryption to preserve privacy and security, which makes network traffic inspection difficult. For better network monitoring and analysis, we explore network traffic signatures in IMAs. We develop a framework to automatically generate and capture traffic from seven popular IMAs. We discover patterns from text messaging behavior, such as synchronous and asynchronous as well as group and private communications. We analyze the resulting end-to-end encrypted traffic using a machine learning-based approach to traffic metadata without using deep packet inspection. The evaluations show that it is possible to identify between groups with different numbers of users for asynchronous and synchronous communication models. This, in turn, can help better plan and manage network operations for better quality of service.