Obfuscation of sensitive data in network flows

Abstract

Abstract-In the last decade, the release of network flows has gained significant popularity among researchers and networking communities. Indeed, network flows are a fundamental tool for modeling the network behavior, identifying security attacks, and validating research results. Unfortunately, due to the sensitive nature of network flows, security and privacy concerns discourage the publication of such datasets. On the one hand, existing techniques proposed to sanitize network flows do not provide any formal guarantees. On the other hand, microdata anonymization techniques are not directly applicable to network flows. In this paper, we propose a novel obfuscation technique for network flows that provides formal guarantees under realistic assumptions about the adversary's knowledge. Our work is supported by extensive experiments with a large set of real network flows collected at an important Italian Tier II Autonomous System, hosting sensitive government and corporate sites. Experimental results show that our obfuscation technique preserves the utility of network flows for network traffic analysis.

A study of usability-aware network trace anonymization

“…Netshuffle works by employing k-anonymity methodology on network traces, by ensuring that all trace records appear at least k>1, with k being the anonymized record, and then shuffling gets applied on the kanonymized records, making it difficult for an attacker to decipher due to the distortion [14]. A network trace obfuscation methodology, (k, j)-obfuscation, was proposed by Riboni, Villani, Vitali, Bettini, and Mancini (2012), in which a network flow is considered obfuscated if it cannot be linked with greater assurance, to its source and destination IP addresses [15]. Riboni, et al observed from their implementation of (k, j)-obfuscation, that the large set of network flows maintained the utility of the original network trace [15].…”

“…A network trace obfuscation methodology, (k, j)-obfuscation, was proposed by Riboni, Villani, Vitali, Bettini, and Mancini (2012), in which a network flow is considered obfuscated if it cannot be linked with greater assurance, to its source and destination IP addresses [15]. Riboni, et al observed from their implementation of (k, j)-obfuscation, that the large set of network flows maintained the utility of the original network trace [15]. However, the context of data utility remains challenging as each consumer of privatized data will have unique usability requirements, different levels of needed assurance, and therefore, utility becomes constrained to a case-by-case basis, depending on an entity's privacy and usability needs.…”

Obsidian: A scalable and efficient framework for NetFlow obfuscation

“…Unfortunately, balancing confidentiality protection and data utility when obfuscating network flows is a complex task. In order to limit the generalization of fp-QI values, (k, j)-obfuscation adopts sophisticated methods [3] to partition network hosts in homogeneous groups with respect to their typical traffic patterns. This operation requires: (i) scan of the Fig.…”

“…In our previous research [3], we presented (k, j)-obfuscation: a new obfuscation technique for network flows, that provides formal confidentiality guarantees under realistic assumptions about the adversary's knowledge, while preserving the utility of released data. This extended abstract briefly introduces Obsidian, a scalable and efficient Python implementation of the extended version of the (k, j)-obfuscation technique.…”

Security issues in network virtualization for the future Internet

“…A cryptographic technique to scramble the host part of IP addresses in traces was introduced in [86]. An obfuscation algorithm using a many-to-one mapping between IP addresses and group-ID values was proposed in [94] to protect the sensitive data in network flows. While these anonymization techniques are effective with respect to network measurement and trace collection systems, they do not meet our security requirements -in particular session unlinkability.…”