Peek-a-Boo, I Still See You: Why Efficient Traffic Analysis Countermeasures Fail. Dyer, K. P., Coull, S., Ristenpart, T., & Shrimpton, T. 05/2012 2012.
abstract   bibtex   
We consider the setting of HTTP traffic over encrypted tunnels, as used to conceal the identity of websites visited by a user. It is well known that traffic analysis (TA) attacks can accurately identify the website a user visits despite the use of encryption, and previous work has looked at specific attack/countermeasure pairings. We provide the first comprehensive analysis of general-purpose TA countermeasures. We show that nine known countermeasures are vulnerable to simple attacks that exploit coarse features of traffic (e.g., total time and bandwidth). The considered countermeasures include ones like those standardized by TLS, SSH, and IPsec, and even more complex ones like the traffic morphing scheme of Wright et al. As just one of our results, we show that despite the use of traffic morphing, one can use only total upstream and downstream bandwidth to identify \textemdashwith 98% accuracy\textemdash which of two websites was visited. One implication of what we find is that, in the context of website identification, it is unlikely that bandwidth-efficient, general- purpose TA countermeasures can ever provide the type of security targeted in prior work.
@conference {oakland2012-peekaboo,
	title = {Peek-a-Boo, I Still See You: Why Efficient Traffic Analysis Countermeasures Fail},
	booktitle = {Proceedings of the 2012 IEEE Symposium on Security and Privacy},
	year = {2012},
	month = {05/2012},
	publisher = {IEEE Computer Society},
	organization = {IEEE Computer Society},
	address = {San Francisco, CA, USA},
	abstract = {We consider the setting of HTTP traffic over encrypted tunnels, as used to conceal the identity of websites visited by a user. It is well known that traffic analysis (TA) attacks can accurately identify the website a user visits despite the use of encryption, and previous work has looked at specific attack/countermeasure pairings. We provide the first comprehensive analysis of general-purpose TA countermeasures. We show that nine known countermeasures are vulnerable to simple attacks that exploit coarse features of traffic (e.g., total time and bandwidth). The considered countermeasures
include ones like those standardized by TLS, SSH, and IPsec, and even more complex ones like the traffic morphing scheme of Wright et al. As just one of our results, we show that despite the use of traffic morphing, one can use only
total upstream and downstream bandwidth to identify {\textemdash}with 98\% accuracy{\textemdash} which of two websites was visited. One implication of what we find is that, in the context of website identification, it is unlikely that bandwidth-efficient, general-
purpose TA countermeasures can ever provide the type of security targeted in prior work.

},
	keywords = {encrypted traffic, machine learning, padding, privacy, traffic analysis countermeasures},
	author = {Kevin P. Dyer and Scott Coull and Thomas Ristenpart and Thomas Shrimpton}
}

Downloads: 0