Peek-a-Boo, I Still See You: Why Efficient Traffic Analysis Countermeasures Fail

Abstract

We consider the setting of HTTP traffic over encrypted tunnels, as used to conceal the identity of websites visited by a user. It is well known that traffic analysis (TA) attacks can accurately identify the website a user visits despite the use of encryption, and previous work has looked at specific attack/countermeasure pairings. We provide the first comprehensive analysis of general-purpose TA countermeasures. We show that nine known countermeasures are vulnerable to simple attacks that exploit coarse features of traffic (e.g., total time and bandwidth). The considered countermeasures include ones like those standardized by TLS, SSH, and IPsec, and even more complex ones like the traffic morphing scheme of Wright et al. As just one of our results, we show that despite the use of traffic morphing, one can use only total upstream and downstream bandwidth to identifywith 98% accuracy-which of two websites was visited. One implication of what we find is that, in the context of website identification, it is unlikely that bandwidth-efficient, generalpurpose TA countermeasures can ever provide the type of security targeted in prior work.

Website Fingerprinting Defenses at the Application Layer

“…Link-padding has been used for traffic morphing to cause confusion in the classifier by disguising the target page fingerprint as that of another page [32]. However, as Dyer et al note [9], traffic morphing techniques produce high bandwidth overheads as some packets must be buffered for a long period. The strategy we follow in ALPaCA is different from traffic morphing in that page contents are not disguised as other pages', but rather the content is modified to become less fingerprintable.…”

“…In 2012, Dyer et al presented BuFLO [9], a defense based on constant-rate link-padding. Although BuFLO is a proof-of-concept defense and has high bandwidth overheads, other defenses have been developed from the original BuFLO design.…”

“…High level features such as the number of requests the browser makes to download a page, the order of these requests and the size of each response, induce distinctive low level features observed in the network traffic [9,21]. For instance, the number of requests sent by the browser corresponds to the number of objects embedded in the page such as images, scripts, stylesheets, and so on.…”

“…WF defenses are often theorized at the network level, and try to disrupt statistical patterns via inserting dummy messages in to the packet stream [2,4,9]. Some defenses try to alter the network traffic of a webpage to mimic that of another webpage that is not interesting to the attacker [32].…”

Toward an Efficient Website Fingerprinting Defense

“…Given that bandwidth and latency increases come at a cost to usability and deployability, these defenses must strive for a trade-off between security and performance overheads. Unfortunately, the state-of-the-art link-padding defenses are not acceptable for use in Tor: they increase latency, delaying page loads between two and four times and impose bandwidth overheads between 40% [4] and 350% [8] on average.…”