UC Irvine

In this thesis, we propose AntMonitor – a complete system for passive monitoring, collection, and analysis of fine-grained, large-scale packet measurements from mobile devices. We design AntMonitor as a VPN-based service, and we develop and compare two versions of the architecture, Client-Server and Mobile-Only. We show that the AntMonitor Mobile-Only prototype significantly outperforms the Client-Server one, as well as all comparable state-of-the-art approaches w.r.t. throughput and energy. It achieves speeds of over 90 Mbps (downlink) and 65 Mbps (uplink), which are 2x and 8x throughput of existing mobile-only approaches, and at 94% of the throughput without VPN. These speeds are achieved while using 2–12x less energy. We also argue that AntMonitor is uniquely positioned to support a number of passive monitoring applications, namely: (i) real-time detection and prevention of private information leakage from the device to the network; (ii) passive performance measurements network-wide as well as per-user; and (iii) application classification based on TCP/IP header features. Furthermore, the Mobile-Only design helps AntMonitor to scale with ease and provides enhanced privacy protection. We present results from a pilot user study at UCI and highlight the key design choices and optimizations that allow AntMonitor to achieve significant benefits.