Generative AI (GenAI) chatbots are now pervasive in digital ecosystems, yet their network traffic remains largely underexplored. This study presents an in-depth investigation of traffic generated by three leading chatbots (ChatGPT, Copilot, and Gemini) when accessed via Android mobile apps for both text and image generation. Using a dedicated capture architecture, we collect and label two complementary workloads: a 60-hour generic dataset with unconstrained prompts, and a controlled dataset built from identical prompts across GenAI apps and replicated via conventional messaging apps to enable one-to-one comparisons. This dual design allows us to address practical research questions on the distinctiveness of GenAI traffic, its differences from widely deployed traffic categories, and its novel implications for network usage. To this end, we provide fine-grained traffic characterization at trace, flow, and protocol levels, and model packet-sequence dynamics with Multimodal Markov Chains. Our analyses reveal app- and content-specific traffic patterns, particularly in volume, uplink/downlink profiles, and protocol adoption. We highlight the predominance of TLS, with Gemini extensively leveraging QUIC, ChatGPT exclusively using TLS 1.3, and app- and content-specific Server Name Indication (SNI) values. A payload-based occlusion analysis quantifies SNI's contribution to classification: masking it reduces F1-score by up to 20 percentage points in GenAI app traffic classification. Finally, compared with conventional messaging apps when carrying the same content, GenAI chatbots exhibit unique traffic characteristics, highlighting new stress factors for mobile networks, such as sustained upstream activity, with direct implications for network monitoring and management. We publicly release the datasets to support reproducibility and foster extensions to other use cases.

翻译：生成式人工智能（GenAI）聊天机器人如今已广泛渗透至数字生态系统，但其网络流量特性仍未得到充分探究。本研究针对三种主流聊天机器人（ChatGPT、Copilot和Gemini）通过Android移动应用进行文本与图像生成时产生的流量开展深度分析。通过构建专用捕获架构，我们收集并标注了两类互补的工作负载数据集：包含60小时无约束提示的通用数据集，以及基于相同提示在GenAI应用与复现于传统通信应用中生成的对照数据集，以实现一对一的对比分析。这种双重设计使我们能够探讨以下实际研究问题：GenAI流量的独特性、其与广泛部署流量类别的差异，以及对网络使用的新型影响。为此，我们在追踪流、数据流和协议层级提供了细粒度的流量特征描述，并采用多模态马尔可夫链对数据包序列动态进行建模。分析揭示了应用特定与内容特定的流量模式，尤其在数据量、上下行流量分布及协议采用方面表现显著。我们重点指出TLS的主导地位，其中Gemini大量采用QUIC协议，ChatGPT则独占性地使用TLS 1.3，且存在应用与内容特定的服务器名称指示（SNI）值。基于载荷的遮蔽分析量化了SNI对分类的贡献度：在GenAI应用流量分类中遮蔽SNI会使F1分数降低高达20个百分点。最后，与传统通信应用在承载相同内容时相比，GenAI聊天机器人展现出独特的流量特征，凸显了对移动网络的新压力因素（如持续的上行活动），这对网络监控与管理具有直接启示。我们公开释放本研究所用数据集，以支持研究可复现性并促进其在其他应用场景的拓展。