Analyzing and Investigating encrypted traffic for social media application Instagram

Social networking applications have significantly attributed to an increase in network traffic both from offices and homes. Different organizations deploy firewalls to improve their network utilization and efficiency of resources, however, these firewalls can only handle plain traffic, whereas social media applications have encrypted traffic. In this paper, we focus on Instagram which is a widely used social media application, and forensically analyze its network encrypted traffic to detect user activity for a modern firewall development system. We investigate the traffic and role of standard servers, content delivery networks (CDNs), and application programming interface (API) servers to find a solution to the problem. We analyze the traffic based on DNS records, its flow, and instantaneous application data from encrypted traffic packets by using simple deep packet inspection (DPI) and statistical techniques. We have successfully detected user chat activity and provided significant features to distinguish between chat and normal webpage browsing. We have also provided a new setup to generate real-time activities from both computer browsers and android mobile applications and acquire datasets automatically for research purposes.