@article{mcniece_li_reaves_2021, title={Characterizing the Security of Endogenous and Exogenous Desktop Application Network Flows}, volume={12671}, ISBN={["978-3-030-72581-5"]}, ISSN={["1611-3349"]}, DOI={10.1007/978-3-030-72582-2_31}, abstractNote={Most desktop applications use the network, and insecure communications can have a significant impact on the application, the system, the user, and the enterprise. Understanding at scale whether desktop application use the network securely is a challenge because the application provenance of a given network packet is rarely available at centralized collection points. In this paper, we collect flow data from 39,758 MacOS devices on an enterprise network to study the network behaviors of individual applications. We collect flows locally on-device and can definitively identify the application responsible for every flow. We also develop techniques to distinguish “endogenous” flows common to most executions of a program from “exogenous” flows likely caused by unique inputs. We find that popular MacOS applications are in fact using the network securely, with 95.62% of the applications we study using HTTPS. Notably, we observe security sensitive-services (including certificate management and mobile device management) do not use ports associated with secure communications. Our study provides important insights for users, device and network administrators, and researchers interested in secure communication.}, journal={PASSIVE AND ACTIVE MEASUREMENT, PAM 2021}, author={McNiece, Matthew R. and Li, Ruidan and Reaves, Bradley}, year={2021}, pages={531–546} }