The devil and packet trace anonymization

Abstract

Releasing network measurement data-including packet tracesto the research community is a virtuous activity that promotes solid research. However, in practice, releasing anonymized packet traces for public use entails many more vexing considerations than just the usual notion of how to scramble IP addresses to preserve privacy. Publishing traces requires carefully balancing the security needs of the organization providing the trace with the research usefulness of the anonymized trace. In this paper we recount our experiences in (i) securing permission from a large site to release packet header traces of the site's internal traffic, (ii) implementing the corresponding anonymization policy, and (iii) validating its correctness. We present a general tool, tcpmkpub, for anonymizing traces, discuss the process used to determine the particular anonymization policy, and describe the use of meta-data accompanying the traces to provide insight into features that have been obfuscated by anonymization.

Outside the Closed World: On Using Machine Learning for Network Intrusion Detection

“…One can also sanitize captured data by, e.g., removing or anonymizing potentially sensitive information [49], [50], [51]. However, despite intensive efforts [52], [53], publishing such datasets has garnered little traction to date, mostly one suspects for the fear that information can still leak.…”

Workload Modeling for Computer Systems Performance Evaluation

“…In fact, comprehensive anonymization is not easy to achieve [532]. For example, hosts can also be compromised by port numbers (if they support a unique service) or even by packet timestamps (by fingerprinting a host's clock drift [408]).…”

“…But this risk does not justify the blocking of all data publication. Rather, a privacy policy should be decided on, which will balance the usefulness of the data with the risk of exposure [532,147]. In certain cases -notably the recording of network communications -there may also be specific laws that spell out exactly what is allowed or not [522].…”

A privacy-aware access control model for distributed network monitoring

“…Although such frameworks are aimed to be quite generic, a significant drawback is that they base on quite "static" anonymisation policies specification; in all cases, the policies that will regulate the execution of the underlying anonymisation APIs must be defined in an explicit manner. Additionally, although they work well for applications using previously collected traffic data, they are not applicable to applications' domains that demand real-time data, such as intrusion detection systems, while being vulnerable to attacks able to infer sensitive information [22] [23].…”