Encrypted Mobile Social Media Traffic Fingerprinting Dataset

Abstract

This dataset contains encrypted mobile network traffic collected from ten widely used Android social media applications: Facebook, Instagram, LinkedIn, Reddit, Snapchat, Telegram, TikTok, Twitter, WhatsApp, and YouTube. Traffic was captured over five independent collection days under controlled experimental conditions and processed using NFStream to generate bidirectional flow-level records. The dataset comprises 25,116 labeled network flows extracted from 50 packet capture (PCAP/PCAPNG) files, with each application represented by five independent capture sessions. The published data contain the complete set of NFStream-extracted flow features, including statistical flow characteristics, packet-size statistics, timing information, transport-layer attributes, and encrypted-session metadata. This repository provides the raw NFStream feature dataset used in our study. Feature selection, leakage-control preprocessing, temporal train/test partitioning, and multi-flow aggregation were performed during the experimental pipeline and are described in the accompanying manuscript. The dataset was developed to support reproducible research in encrypted traffic analysis, mobile application fingerprinting, digital forensics, network security, and explainable artificial intelligence. It accompanies the manuscript "Encrypted Social Media Traffic Fingerprinting under Temporal Shift: A Public Benchmark and Multi-Flow Evaluation." If you use this dataset, please cite: Bright Jiwueze, et al. Encrypted Social Media Traffic Fingerprinting under Temporal Shift: A Public Benchmark and Multi-Flow Evaluation. Preprints.org, 2026. https://doi.org/10.20944/preprints202609.0324.v1