NYU Tandon researchers adapt cybersecurity tool to monitor health through smartphone traffic

Borrowing a cybersecurity technique originally designed to catch malware, researchers at NYU Tandon School of Engineering have developed a new tool for monitoring human health without invasive wearables or unreliable self-reporting.

The method, dubbed RouterSense, passively analyzes encrypted network traffic on a person's smartphone or other digital device, tracking their digital behaviors to potentially shed light on conditions ranging from mental health struggles in young adults to early signs of Alzheimer's disease.

"Traffic patterns serve as proxies for digital biomarkers," explained Danny Huang, the project’s senior researcher. "Screen time indicates sleep patterns, texting frequency reflects social interaction, and app usage reveals productivity rhythms, for example."

Huang is an NYU Tandon assistant professor with appointments in the Electrical and Computer Engineering Department (ECE) and in the Computer Science and Engineering Department. He is also on the faculties of the NYU Center for Cybersecurity, the Center for Urban Science + Progress and the Center for Advanced Technology in Telecommunications.

Because the system only captures metadata — information about digital activity such as which apps are contacted rather than the activity itself — it never sees any actual content, keeping the person's messages, videos, and other online activity private. The approach works across a diverse set of devices: phones, tablets, PCs, whether they run on Apple, Android, or Windows systems.

The analysis RouterSense employs has long been used in cybersecurity to spot malware by detecting unusual communication patterns, such as a device suddenly sending data to an unknown server or making suspicious connection requests. RouterSense flips this, tracking an individual's normal smartphone patterns instead of flagging threats.

"For the past fifteen years, I've been using network traffic analysis to understand how cybercriminals behave," said Huang. "My prior work has demonstrated that network traffic analysis could reveal behavioral patterns at scale while protecting privacy, lessons we're now applying to healthcare."

The research, recently released as a preprint in the Journal of Medical Internet Research, promises notable benefits over current standard health monitoring. Self reports are often riddled with recall bias. Intrusive sensors and smartphone apps can drain batteries and make people acutely aware they're being monitored. RouterSense, by contrast, is low-cost, unobtrusive, and scalable to large populations.

In a proof-of-concept study, 38 NYU students installed a VPN app on their smartphones for two weeks, which routed all their internet traffic through a research server in an NYU lab for analysis. Of the 29 participants who contributed valid data, 27 remained active for more than five days, contributing an average of over 300 hours of monitored network traffic.

The system successfully captured daily activity rhythms and lifestyle patterns, including gaming habits and late-night food delivery use, demonstrating the feasibility of passive monitoring. Participants reported the system was easy to use with many noting they forgot they were being monitored.

"Our approach allows us to increase the bandwidth of patient monitoring for months to years," said lead author Rameen Mahmood, an NYU Tandon ECE Ph.D. candidate. "Network traffic analysis lets us do passive monitoring 24-7 over an extended period of time, which hasn't really been done before."

This visualization showcases data from two participants in the researchers' 14-day pilot study with 27 NYU students. Each ring represents a full day of passively monitored internet activity from their mobile phones. The dots illustrate 10-minute intervals of internet usage, with red indicating high activity and blue indicating low activity. Notice the clear difference in patterns: Participant A demonstrates a consistent daily routine, including a regular sleep schedule (the prominent blue region at night), while Participant B's activity is more varied. Click to view larger image.

The NYU Tandon study's success in demonstrating feasibility and acceptability has paved the way for clinical applications.

The researchers are now recruiting individuals with pre-Alzheimer's conditions for a 30-day monitoring study comparing their network traffic patterns with healthy controls, the crucial next step in determining whether RouterSense can detect early signs of cognitive decline.

Other areas the researchers plan to explore include digital behaviors related to mindless eating and brain development in younger populations.

In addition to Huang, Mahmood and Kaye, the paper’s authors are Donghan Hu and Annabelle David (NYU Tandon), Zachary Beattie (Oregon Health & Science University), Nabil Alshurafa (Northwestern University), Lou Haux (Max Planck Institute for Human Development), Josiah Hester (Georgia Institute of Technology), Andrew Kiselica (University of Georgia), Shinan Liu (University of Hong Kong), and Chenxi Qiu and Chao-Yi Wu (Harvard Medical School).