Analytical and empirical analysis of countermeasures to traffic analysis attacks

Abstract. In this paper, we address issues related to flow correlation attacks and the corresponding countermeasures in mix networks. Mixes have been used in many anonymous communication systems and are supposed to provide countermeasures that can defeat various traffic analysis attacks. In this paper, we focus on a particular class of traffic analysis attack, flow correlation attacks, by which an adversary attempts to analyze the network traffic and correlate the traffic of a flow over an input link at a mix with that over an output link of the same mix. Two classes of correlation methods are considered, namely time-domain methods and frequency-domain methods. Based on our threat model and known strategies in existing mix networks, we perform extensive experiments to analyze the performance of mixes. We find that a mix with any known batching strategy may fail against flow correlation attacks in the sense that for a given flow over an input link, the adversary can correctly determine which output link is used by the same flow. We also investigated methods that can effectively counter the flow correlation attack and other timing attacks. The empirical results provided in this paper give an indication to designers of Mix networks about appropriate configurations and alternative mechanisms to be used to counter flow correlation attacks.

show abstract

“…In this paper, we assume that the adversary uses a classical timing analysis attack ( [1,22]), which we summarize as follows:…”

Section: Threat Modelmentioning

confidence: 99%

“…It is likely more effective because periodic traffic patterns are very difficult to generate with sufficient accuracy. We showed in NetCamo [22,34], for example, how high-accuracy traffic analysis can easily break periodic link padding schemes.…”

Section: Overviewmentioning

confidence: 99%

On Flow Correlation Attacks and Countermeasures in Mix Networks

Zhu

Graham

et al. 2005

Privacy Enhancing Technologies

121

125

View full text Add to dashboard Cite

show abstract

“…Layered encryption is often used in anonymity protocols [7,28]. Traffic covering can prevent traffic timing analysis [13,17]. These techniques often work together to achieve anonymity.…”

Section: Anonymous Unicastmentioning

confidence: 99%

A design of overlay anonymous multicast protocol

Xiao

Liu

et al. 2006

Proceedings 20th IEEE International Parallel &Amp; Distributed Processing Symposium

View full text Add to dashboard Cite

show abstract

“…In this section, we will describe one such system, which we developed and experimentally evaluated on a number of platforms, ranging from general-purpose to realtime [3]. We think that NetCamo is representative of many link padding implementations and believe that results described here can be at least qualitatively applied to any general link padding implementation.…”

Section: Canonical Link Padding Implementationmentioning

confidence: 99%

“…These disturbances perturb the generation of controlled, padded traffic. It has been shown that even sophisticated software implementations with tight timing control on real-time operating systems show this effect [3].…”

Section: Introductionmentioning

confidence: 99%