Optimum packet length masking

Abstract

Application level traffic classification has been addressed in demonstrated recently based on statistical features of packet flows. Among the most significant characteristics is packet length. Even ciphered flows leak information about their content through the sequence of packet length values. There are obvious ways to destroy such side information, e.g. by setting all packet at maximum allowed length. This approach could ential an extremely large overhead, which makes it impractical. There is room to investigate the optimal trade-off between overhead/complexity of packet length masking and suppression of information leakage about flow content through packet length values. In this work we characterize the optimum first order statistical padding technique which guarantees indistinguishability of different application flows. We also discuss how to account for subsequent packet length correlation. Numerical results are shown with reference to real network traffic traces, specifically flows of HTTP, POP3, SSH, and FTP (control session) traffic

Internet Traffic Privacy Enhancement with Masking: Optimization and Tradeoffs

“…With additive masking the masked featureṼ is built asṼ ¼ V ðiÞ þ U ðiÞ , with U ðiÞ a suitable nonnegative random variable such that the pdf ofṼ is independent of i (1 i M). In [15], it is shown that minimum overhead additive masking is obtained by choosing FṼ ðvÞ ¼ minfF This choice minimizes E½Ṽ , hence E½U ðiÞ for a given value of E½V ðiÞ , 1 i M. Once FṼ ðvÞ is computed, the pdf of the U ðiÞ s can be calculated. Given a sample v of V ðiÞ , the masking quantity is sampled from the pdf of U ðiÞ , say u, and the masked feature value is v þ u, with u !…”

Concurrent multipath traffic impersonating for enhancing communication privacy

“…Although this approach may alleviate the problem, it is usually inefficient and easy to incur high overheads. Iacovazzi et al . characterized the optimum first‐order statistical padding technique, which makes different application flows indistinguishable.…”

“…Although this approach may alleviate the problem, it is usually inefficient and easy to incur high overheads. Iacovazzi et al [13] characterized the optimum first-order statistical padding technique, which makes different application flows indistinguishable. Shui Yu et al [14] implement a strategy to introduce dummy packet padding into a flow in order to guarantee perfect anonymity on web browsing.…”

Probability Density Functions of the Packet Length for Computer Networks with Bimodal Traffic

“…Besides that, knowledge of the applications used by the subscribers may be of interest for application-based accounting and charging or even for the Internet Service Provider (ISP) to offer new products [1]- [6]. Characterization of Internet traffic is an important issue for telecommunications networks [7]. The literature presents several traffic identification techniques, and those using packet length (size) are important strategies [1]- [24].…”

“…Li Bo, for example, indicates that the packet size (or length) distribution can be used to identify many Transport Control Protocol (TCP) applications [18]. Alfonso Iacovazzi reports that statistical traffic classification is possible based on some features of the Internet Protocol (IP) flow and that the packet length is a key feature to classify the application level content of a packet flow and that this classification can be useful for security policies, traffic filtering and support to the quality of service mechanisms [7]. Mushtaq mentioned that the probability density function and the cumulative distribution function can be used to design, control, manage, interpolate and extrapolate the network traffic.…”