TagIt: Tagging Network Flows using Blind Fingerprints

Rezaei, Fatemeh; Houmansadr, Amir

doi:10.1515/popets-2017-0050

Cited by 7 publications

(12 citation statements)

References 38 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…While ow correlation is the core of a multitude of attacks on Tor [3,8,20,22,28,38,39,49,52,54,70,72,72,83], existing ow correlation algorithms are assumed to be ine ective in linking Tor connections reliably and at scale [37,55,66]. This is due to Tor's extremely noisy network that applies large perturbations on Tor ows, therefore rendering tra c features across associated ingress and egress Tor ows hard to get reliably correlated.…”

Section: This Paper's Contributionsmentioning

confidence: 99%

“…While previous work has studied di erent countermeasures against ow correlation and similar tra c analysis attacks [2,9,19,35,41,42,50,56,61,82], they remain mostly non-deployed presumably due to the poor performance of existing ow correlation techniques at large scale [60,66]. In the following, we discuss two possible countermeasures.…”

Section: Countermeasuresmentioning

confidence: 99%

“…Despite the critical role of ow correlation in a multitude of Tor attacks, ow correlating Tor connections has long been considered to be ine cient at scale [37,55,66]-but not anymore! Even though Tor relays do not actively manipulate packet timings and sizes to resist ow correlation, the Tor network naturally perturbs Tor packets by signi cant amounts, rendering ow correlation a di cult problem in Tor.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

DeepCorr

Nasr

Bahramali

Houmansadr

2018

Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security

Self Cite

102

View full text Add to dashboard Cite

Flow correlation is the core technique used in a multitude of deanonymization attacks on Tor. Despite the importance of ow correlation attacks on Tor, existing ow correlation techniques are considered to be ine ective and unreliable in linking Tor ows when applied at a large scale, i.e., they impose high rates of false positive error rates or require impractically long ow observations to be able to make reliable correlations. In this paper, we show that, unfortunately, ow correlation attacks can be conducted on Tor tra c with drastically higher accuracies than before by leveraging emerging learning mechanisms. We particularly design a system, called DeepCorr, that outperforms the state-of-the-art by signicant margins in correlating Tor connections. DeepCorr leverages an advanced deep learning architecture to learn a ow correlation function tailored to Tor's complex network-this is in contrast to previous works' use of generic statistical correlation metrics to correlate Tor ows. We show that with moderate learning, DeepCorr can correlate Tor connections (and therefore break its anonymity) with accuracies signi cantly higher than existing algorithms, and using substantially shorter lengths of ow observations. For instance, by collecting only about 900 packets of each target Tor ow (roughly 900KB of Tor data), DeepCorr provides a ow correlation accuracy of 96% compared to 4% by the state-of-the-art system of RAPTOR using the same exact setting.We hope that our work demonstrates the escalating threat of ow correlation attacks on Tor given recent advances in learning algorithms, calling for the timely deployment of e ective countermeasures by the Tor community.

show abstract

Section: This Paper's Contributionsmentioning

confidence: 99%

Section: Countermeasuresmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

DeepCorr

Nasr

Bahramali

Houmansadr

2018

Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security

Self Cite

102

View full text Add to dashboard Cite

show abstract

“…According to the carrier type, NFW is usually classified into four categories: content [5], timing [6], size [7], and rate-based [8]. In these categories, however, timing-based watermarking [9,10], in which the carrier signal is the arrival or departure time of the packets observed at a certain network node, has been mostly researched.…”

Section: Introductionmentioning

confidence: 99%

Using Insider Swapping of Time Intervals to Perform Highly Invisible Network Flow Watermarking

Liu

Xiao-ling

et al. 2018

Security and Communication Networks

View full text Add to dashboard Cite

Network flow watermarking (NFW) is an emerging flow correlation technique to deanonymize an anonymous communication system or detect stepping stones, in which a watermark is encoded into a network flow by manipulating some flow characteristics, predominantly by altering timing information. Although interval-based NFWs that employ time intervals as carrier have proven to be capable of resisting moderate network interference, they are vulnerable to some statistic-based attacks, which may expose the very existence of watermark and enable attackers to damage or remove watermark from the observed flow. In this study, using insider swapping of time intervals and an adaptive centroid quantization framework, we design a highly invisible NFW scheme, which is undetectable by multi-flow attacks (MFA), Kullback-Leibler divergence (KLD) test, Kolmogorov-Smirnov (K-S) test, and spread spectrum flow watermark (SSFW) detection. Experimental results using real traffic and public dataset show that the proposed NFW scheme can outperform three typical NFW schemes on invisibility while maintaining a strong interference-resistance capability of network jitter, packet loss, and dummy packet insertion.

show abstract

“…Rezaei et al. [24] introduce an active fingerprinting method called TagIt that works by slightly delaying packets into secret time intervals. In [25], [26], the authors consider watermarking and analyze invisibility and error probability of watermarking schemes in practice.…”

mentioning

confidence: 99%

Fundamental Limits of Invisible Flow Fingerprinting

Soltani

Goeckel

Towsley

et al. 2020

IEEE Trans.Inform.Forensic Secur.

Self Cite

View full text Add to dashboard Cite

Network flow fingerprinting can be used to de-anonymize communications on anonymity systems such as Tor by linking the ingress and egress segments of anonymized connections. Assume Alice and Bob have access to the input and the output links of an anonymous network, respectively, and they wish to collaboratively reveal the connections between the input and the output links without being detected by Willie who protects the network. Alice generates a codebook of fingerprints, where each fingerprint corresponds to a unique sequence of interpacket delays and shares it only with Bob. For each input flow, she selects a fingerprint from the codebook and embeds it in the flow, i.e., changes the packet timings of the flow to follow the packet timings suggested by the fingerprint, and Bob extracts the fingerprints from the output flows. We model the network as parallel M/M/1 queues where each queue is shared by a flow from Alice to Bob and other flows independent of the flow from Alice to Bob. The timings of the flows are governed by independent Poisson point processes. Assuming all input flows have equal rates and that Bob observes only flows with fingerprints, we first present two scenarios: 1) Alice fingerprints all the flows; 2) Alice fingerprints a subset of the flows, unknown to Willie. Then, we extend the construction and analysis to the case where flow rates are arbitrary as well as the case where not all the flows that Bob observes have a fingerprint. For each scenario, we derive the number of flows that Alice can fingerprint and Bob can trace by fingerprinting.

show abstract

TagIt: Tagging Network Flows using Blind Fingerprints

Cited by 7 publications

References 38 publications

DeepCorr

DeepCorr

Using Insider Swapping of Time Intervals to Perform Highly Invisible Network Flow Watermarking

Fundamental Limits of Invisible Flow Fingerprinting

Contact Info

Product

Resources

About