In this thesis, we propose AntMonitor – a complete system for passive monitoring, collection, and analysis of fine-grained, large-scale packet measurements from mobile devices. We design AntMonitor as a VPN-based service, and we develop and compare two versions of the architecture, Client-Server and Mobile-Only. We show that the AntMonitor Mobile-Only prototype significantly outperforms the Client-Server one, as well as all comparable state-of-the-art approaches w.r.t. throughput and energy. It achieves speeds of over 90 Mbps (downlink) and 65 Mbps (uplink), which are 2x and 8x throughput of existing mobile-only approaches, and at 94% of the throughput without VPN. These speeds are achieved while using 2–12x less energy. We also argue that AntMonitor is uniquely positioned to support a number of passive monitoring applications, namely: (i) real-time detection and prevention of private information leakage from the device to the network; (ii) passive performance measurements network-wide as well as per-user; and (iii) application classification based on TCP/IP header features. Furthermore, the Mobile-Only design helps AntMonitor to scale with ease and provides enhanced privacy protection. We present results from a pilot user study at UCI and highlight the key design choices and optimizations that allow AntMonitor to achieve significant benefits.

Mobile devices carry sensitive information that is routinely transmitted over the network and is often collected for analytics and targeted advertising purposes. Users are typically unaware of this data collection and have little control over their information. In this thesis, we develop systems and techniques that provide users with increased transparency and control over their mobile data. We develop AntMonitor - a user space app that can inspect and analyze all network traffic coming in and out of the device. AntMonitor outperforms prior art in terms of network throughput and CPU usage. Our tool enables real-time packet interception and analysis on the mobile device, including the following three applications. First, we build AntShield, which builds on top of AntMonitor to intercept packets, and uses a combination of deep packet inspection and machine learning to detect and block outgoing traffic that contains personally identifiable information. Second, we develop NoMoAds - the first mobile-specific, cross-app, machine learning-based ad-blocker, and we show that it outperforms state-of-the-art filter lists. Third, we build AutoLabel - a system for automatically labeling which packets were sent by apps and which by third-party advertisement or analytics libraries. This eliminates the need for manual labeling – which is the major bottleneck in creating filter lists and classifiers. Overall, this thesis follows a network-based approach to enhance mobile data transparency and give users control over their data.