The role of network trace anonymization under attack

Abstract

a c m s i g c o m m ABSTRACTIn recent years, academic literature has analyzed many attacks on network trace anonymization techniques. These attacks usually correlate external information with anonymized data and successfully de-anonymize objects with distinctive signatures. However, analyses of these attacks still underestimate the real risk of publishing anonymized data, as the most powerful attack against anonymization is traffic injection. We demonstrate that performing live traffic injection attacks against anonymization on a backbone network is not difficult, and that potential countermeasures against these attacks, such as traffic aggregation, randomization or field generalization, are not particularly effective. We then discuss tradeoffs of the attacker and defender in the so-called injection attack space. An asymmetry in the attack space significantly increases the chance of a successful de-anonymization through lengthening the injected traffic pattern. This leads us to re-examine the role of network data anonymization. We recommend a unified approach to data sharing, which uses anonymization as a part of a technical, legal, and social approach to data protection in the research and operations communities.

A privacy-aware access control model for distributed network monitoring

“…Although such frameworks are aimed to be quite generic, a significant drawback is that they base on quite "static" anonymisation policies specification; in all cases, the policies that will regulate the execution of the underlying anonymisation APIs must be defined in an explicit manner. Additionally, although they work well for applications using previously collected traffic data, they are not applicable to applications' domains that demand real-time data, such as intrusion detection systems, while being vulnerable to attacks able to infer sensitive information [22] [23].…”

IP Flow Anonymization Support

“…Research on network trace anonymization techniques and attacks against them is ongoing. Indeed, there is increasing evidence that anonymization applied to network trace or flow data on its own is insufficient for many data protection applications as in [Bur10]. Therefore, this document explicitly does not recommend any particular technique or implementation thereof.…”

“…Timestamps can be used in traffic injection attacks, which use known information about a set of traffic generated or otherwise known by an attacker to recover mappings of other anonymized fields, as well as to identify certain activity by response delay and size fingerprinting, which compares response sizes and inter-flow times in anonymized data to known values. Note that these attacks have been shown to be relatively robust against timestamp anonymization techniques (see [Bur10]), so the techniques presented in this section are relatively weak and should be used with care.…”

Instrumenting home networks

“…Other information should be anonymized or otherwise obscured to hide users' identities. Unfortunately, it is now pretty well-known that it is very difficult to effectively anonymize network trace data of the kind considered here while preserving its utility for research purposes [4]. In general there is an inverse relationship between the difficulty of of mapping logged addresses and applications to actual real-world counterparts, and the usefulness of the log information for various purposes.…”