This document summarizes research on traffic analysis attacks against anonymity networks and proposed countermeasures. It first provides background on anonymity networks and how traffic analysis can be used to deanonymize users. It then summarizes previous research that used machine learning to classify users' web activity based on packet metadata with over 45% accuracy. The document proposes novel countermeasures that add dummy packets and randomize burst lengths to pad traffic and decrease classification accuracy. Evaluation shows the byte-level fixed burst length countermeasure reduces accuracy to 1.3% but incurs very high overhead, while other approaches provide a better accuracy-overhead tradeoff.

1. Website Traffic Analysis
Michael Freyberger and Michael Chang
ELE 298 Advisor: Professor Prateek Mittal
Princeton University | Electrical Engineering | Class of 2016

2. Motivation
• Anonymity networks are becoming increasingly important
• Free network access in oppressed countries is desirable
• Prevent marketers from tracking web activity
• Current anonymity networks are vulnerable

3. Basic Communication
Client Server

4. Characteristics of Communication
• Information can be readily encrypted
• Data transfer is broken down into packets
• Packets have a direction and length
• Packets have a maximum length called the Maximum Transmission
Unit (MTU)
• A typical size for the MTU is 1500 bytes
148 1500100 516 660 580
Client Request to Server Server Sends Data to Client

5. Scenario 1: Possible Attack
Client Server
Attacker
Encrypted Traffic

6. Scenario 2: Possible Attack with Proxies
Client
Node 1 Node 3
Node 2
Server
Attacker

7. Current Secure Systems
• Cryptographic Security
• SSL
• HTTPS
• Onion Routing Systems
• Tor
• JonDonym
www.torproject.org

8. Tor Project
• 2 Million Users
• Pads all data cell
units to 512 bytes
• Randomly
generates 3
proxies
www.torproject.org

9. Traffic Analysis Attacks
• Single Attacker
• Exploit metadata of the communication
• Total Number of Bytes
• Packet Lengths and Direction
• Packet Bursts
Attacker
www.torproject.org

10. Panchenko et al. [1]
• Combined packet and burst level approach
• Support Vector Machine
• Many features utilized, but primary ones:
• Total Transmitted Bytes
• Number of packets per burst
• Count of each packet size
• Percentage incoming packets
• Achieved accuracy of 47.36% on closed world data set

11. Cai et al. [2]
• Damareau-Levenshtein Edit Distances
• Considers natural re-ordering of the packets during information
exchange
• Features considered
• Packet Sizes
• Direction of Packets
• Classification using SVM (support vector machines)

12. Dyer et al.[3]
• Coarse features contain a lot of information
• Total Time
• Total Bandwidth
• Bursts
• Coarse features are difficult to hide
• BufLo
• High Overhead

13. Recreating Tests and Running our own
• Recreating Cai’s Classifier
• Potential Improvements
• Damereau-Levenshtein Distance transformation penalties
• Burst-level calculations
• Recreating Dyer’s Data set
• Successful
• Data Set Setting retrieved from Tor Nodes
• 8510 websites collected at a rate of 85/hour
• Linux client machine
• Browser: Firefox 2.0

14. Accuracy and Overhead Calculations
•

15. Previously Explored Countermeasures
• Packet Padding Level Padding
• Pad to MTU
• Random Padding
• Exponential Padding
• Sending Dummy Packets
• BuFLO - Send fixed length packets at fixed time intervals

16. Pad to MTU
Overhead: 41.7% Overhead: 41%
148 100 516
1500 1500
No Countermeasure:
Countermeasure Applied: 1500

17. Session Random 255
Overhead: 6.5% Overhead: 6.6%
148 100 516
236 604
No Countermeasure:
Countermeasure Applied: 188
Parameters:
P = 88

18. Exponential Padding
Overhead: 16.5% Overhead: 16.2%
148 100 516
256 1024
No Countermeasure:
Countermeasure Applied: 128

19. Packet Level Countermeasures
•Ineffective – cannot decrease accuracy when classification uses
top performing classifiers
•High Overhead – Cannot decrease accuracy even with
maximal overhead
•Solution: Must apply countermeasures at the burst level

20. Novel Countermeasures
• Burst Level Padding – strategically placed Dummy Packets
• Burst Level Padding in addition to Packet Level Padding
• Random Burst Level Padding
• Bursts defined by number of packets or number of bytes
• Sending Dummy Packets in one direction – Client to Server

21. Communication Legend
Encrypted Packet from Client to Server
Encrypted Packet from Server to Client
Encrypted Burst of Packets from Server to Client. Burst Length defined by number of packets in
the Burst.
Encrypted Burst of Packets from Server to Client. Burst Length defined by number of bytes in the
Burst.

22. Burst Fixed Max Length of 6 Packets
Overhead: 2.9% Overhead: 2.9%
148 100 14516
148 6516 638
No Countermeasure:
Countermeasure Applied: 100
484
6 638 2 484

23. Burst Max Length of 6 Packets with Session
Random Packet Level Padding
Overhead: 9.5% Overhead: 9.4%
148 100 12516
236 6604 638
No Countermeasure:
Countermeasure Applied: 188
484
6 572
Parameters:
P = 88

24. Burst Session Random Fixed Max Length
Overhead: 11.1% Overhead: 11%
148 100 12516
236 7604 638
No Countermeasure:
Countermeasure Applied: 188
484
5 572
Parameters:
P = 88
M = 7

25. Burst Fixed Max Length
Advantages Disadvantages
•Low Overhead
•Effectively mask the bursts
when randomness is added
•Decreases accuracy of VGN++
from 20.3%
•Ineffective without packet
level padding as well
•Does not increase effectiveness
of Session Random 255 with
Panchenko classifier

26. Fixed Burst Lengths at Packet Level
Overhead: 113.1% Overhead: 111.8%
148 100 9516
276 5 5644 638 5
No Countermeasure:
Countermeasure Applied:
Parameters:
P = 128
B = 5

27. 148
Fixed Burst Lengths at Byte Level
100 14674516
292 9118 9118660 638 9118
Overhead: 137% Overhead: 138.1%
No Countermeasure:
Countermeasure Applied:
Parameters:
P = 144
G = 9118

28. Burst Fixed Length
Advantages Disadvantages
•Both implementations achieve
low accuracy against VNG++
•Packet level implementation
achieves low accuracy against
Panchenko
•High Byte Overhead– takes
more than twice as long for a
web page to download
•Potential for high latency
overhead

29. Client to Server Dummy Packets
Overhead: 37.2% Overhead: 37.6%
148 100 6516
206 4596 712 2
No Countermeasure:
Countermeasure Applied:
Parameters:
P = 80
B = 4
C = 3
100 516 968

30. Client to Server Dummy Packets
Advantages Disadvantages
•Low byte level overhead
•Possibly take advantage of
asymmetric bandwidth
•Cannot achieve accuracy
results as strong as Server to
Client Dummy Packets
•Potential for high latency
overhead

31. Summary: Accuracy vs. Overhead Tradeoff
Fixed Burst Lengths at Byte Level
Fixed Burst Lengths at Packet Level
Burst Session Random Fixed Max
Length

32. Conclusion
• Introduced Strategic Dummy Packet Placement– Burst Level
Padding
• Decrease accuracy of most effective countermeasure, Session
Random 255, from 16.6% to 6.4% with Burst Fixed Max Length
• Slight overhead increase from 6.6% to 11.1%
• Decrease accuracy of most effective countermeasure, Session
Random 255, from 16.6% to 1.3% with Fixed Burst Lengths at
Byte Level
• Large overhead increase from 6.6% to 137%

33. Opportunities for Future Research
• Common Characteristics of a Trace: Application of
countermeasure on select parts of trace
• Taking advantage of “anatomy of a trace”
• Taking advantage of User Habits: Eliminating “open-world
concerns” and increasing false positives

34. Acknowledgements
• Our advisor, Professor Prateek Mittal
• Kevin Dyer, for access to his code base and support in
experiment recreations
• Xiang Cai, for access to his code base and support in
experiment recreations

35. Citations
[1] Andriy Panchenko, Lukas Niessen, Andreas Zinnen, and Thomas Engel. Website
Fingerprinting in Onion Routing based Anonymization Networks. In Proceedings of the
Workshop on Privacy in the Electronic Society, pages 103–114, October 2011.
[2] Xiang Cai, Xincheng Zhang, Brijesh Joshi, and Rob Johnson. Touching from a distance:
website fingerprinting attacks and defenses. In ACM CCS, 2012
[3] Kevin P. Dyer, Scott E. Coull, Thomas Ristenpart, and Thomas Shrimpton. Peek-a-boo, i
still see you: Why e fficient traff c analysis countermeasures fail. In Proceedings of the 33rd
Annual IEEE Symposium on Security and Privacy, 2012.