论文标题
利用战略连接迁移驱动的流量分开以进行隐私
Leveraging strategic connection migration-powered traffic splitting for privacy
论文作者
论文摘要
网络级的对手已经开发出越来越复杂的技术来监视和控制用户的网络流量。在本文中，我们利用了我们的观察结果，即许多加密协议连接不再与设备IP地址相关（例如，由于需要在移动优先世界中进行性能，因此在QUIC中的连接迁移功能或IP漫游）。我们设计并实施了一个新颖的框架，连接迁移驱动的拆分（COMPS），该框架利用这些性能功能来增强用户隐私。使用Comps，我们可以将流量中段跨越网络路径和异质网络协议拆分。这种流量分裂可以减轻网络级对手通过限制他们可以观察到的流量量来执行流量分析攻击的能力。我们使用Comps来构建网站指纹防御防御，该防御能够抵抗开放世界中强大的自适应对手的交通分析攻击。我们使用模拟分裂数据和现实世界流量来评估我们的系统，这些数据和现实的流量使用Comps积极分配。在我们的实际实验中，Comps在开放世界设置中分别将VARCNN的精度和召回率分别降低到29.9％和36.7％。 COMPS不仅可以与任何支持连接迁移的不变的服务器立即部署，而且几乎没有开销，仅降低了5-20％的吞吐量。
Network-level adversaries have developed increasingly sophisticated techniques to surveil and control users' network traffic. In this paper, we exploit our observation that many encrypted protocol connections are no longer tied to device IP address (e.g., the connection migration feature in QUIC, or IP roaming in WireGuard and Mosh), due to the need for performance in a mobile-first world. We design and implement a novel framework, Connection Migration Powered Splitting (CoMPS), that utilizes these performance features for enhancing user privacy. With CoMPS, we can split traffic mid-session across network paths and heterogeneous network protocols. Such traffic splitting mitigates the ability of a network-level adversary to perform traffic analysis attacks by limiting the amount of traffic they can observe. We use CoMPS to construct a website fingerprinting defense that is resilient against traffic analysis attacks by a powerful adaptive adversary in the open-world setting. We evaluate our system using both simulated splitting data and real-world traffic that is actively split using CoMPS. In our real-world experiments, CoMPS reduces the precision and recall of VarCNN to 29.9% and 36.7% respectively in the open-world setting with 100 monitored classes. CoMPS is not only immediately deployable with any unaltered server that supports connection migration, but also incurs little overhead, decreasing throughput by only 5-20%.
