Passive Traffic Analysis for Instant Messaging Applications in Mobile Communication Networks Air Interface

User-initiated uplink traffic is crucial for analyzing instant messaging apps like WeChat, as it is closely linked to user privacy. However, obtaining uplink data in cellular networks requires uplink synchronization, which is challenging. Additionally, collecting the entire communication process for traffic analysis can be difficult. In this paper, we propose to utilize the fragmented downlink data to identify the uplink traffic. First, we integrate fragmented data using directed graphs and correlation computation. Next, we differentiate background traffic from service traffic based on the traffic stability index. Finally, we achieve application identification via background traffic, and we accomplish fine-grained service identification using downlink feedback data. We conducted a study on three instant messaging applications and five services on a 4G LTE laboratory network. Remarkably, an F1 score higher than 95% was achieved when the time granularity of traffic data remained within 40 ms or more. Additionally, we assess the effect of various factors on the algorithm's performance. Furthermore, the result of our algorithm is comparable to that obtained using uplink and downlink data both. Additionally, due to similar link layer specifications between 4G LTE and 5G networks, the algorithm proposed in this paper for extension to 5G networks.