Abstract: AntMonitor is a system for passive monitoring, collection, and analysis of fine-grained, large-scale packet measurements from mobile devices. The system may be implemented on top of a VPN-based service and using two possible architectures: Client-Server or Mobile-Only. A current implementation of the Mobile-Only design may outperform other mobile-only approaches: it may achieve, for example, 2× and 8× faster (down and uplink) speeds, and close to the raw no-VPN throughput, while using 2-12× less energy. AntMonitor can scale to a large number of end-users, provide enhanced privacy protection, and enable accurate traffic classification. The system may support (i) real-time detection and prevention of private information leak-age from the device to the network; (ii) passive performance measurements network-wide as well as per-user; and (iii) traffic classification at different granularities (including per-application or per device, and user profiling) based on TCP/IP header features.