Anonymous Networks Research Articles

Discerning the traffic in Anonymous Communication Networks using Machine Learning: Concepts, Techniques and Future Trends

Discerning the traffic in Anonymous Communication Networks using Machine Learning: Concepts, Techniques and Future Trends

Dark-Forest: Analysis on the Behavior of Dark Web Traffic via DeepForest and PSO Algorithm

The dark web is a shadow area hidden in the depths of the Internet, which is difficult to access through common search engines. Because of its anonymity, the dark web has gradually become a hotbed for a variety of cyber-crimes. Although some research based on machine learning or deep learning has been shown to be effective in the task of analyzing dark web traffic in recent years, there are still pain points such as low accuracy, insufficient real-time performance, and limited application scenarios. Aiming at the difficulties faced by the existing automated dark web traffic analysis methods, a novel method named Dark-Forest to analyze the behavior of dark web traffic is proposed. In this method, firstly, particle swarm optimization algorithm is used to filter the redundant features of dark web traffic data, which can effectively shorten the training and inference time of the model to meet the real-time requirements of dark web detection task. Then, the selected features of traffic are analyzed and classified using the DeepForest model as a backbone classifier. The comparison experiment with the current mainstream methods shows that Dark-Forest takes into account the advantages of statistical machine learning and deep learning, and achieves an accuracy rate of 87.84%. This method not only outperforms baseline methods such as Random Forest, MLP, CNN, and the original DeepForest in both large-scale and small-scale dataset based learning tasks, but also can detect normal network traffic, tunnel network traffic and anonymous network traffic, which may close the gap between different network traffic analysis tasks. Thus, it has a wider application scenario and higher practical value.

S-BAN: Secure Blockchain-Based Anonymous Networking Strategy for Privacy-Preserving DSM

S-BAN: Secure Blockchain-Based Anonymous Networking Strategy for Privacy-Preserving DSM

Tabular-to-Image Transformations for the Classification of Anonymous Network Traffic Using Deep Residual Networks

Tabular-to-Image Transformations for the Classification of Anonymous Network Traffic Using Deep Residual Networks

Drive-By Solidarity

This article offers a theoretical and empirical exploration of a form of solidarity in which one group spontaneously mobilizes in support of another, unrelated group. It is a fleeting solidarity based not on shared identity but on temporarily aligned goals, one aimed less at persistence and more at short-term impact. We call this drive-by solidarity because of its spontaneous, unilateral, and unsolicited nature. We argue that it is a “thinner” form of solidarity in comparison to “thicker” forms usually conceptualized in the social movement literature. We examine the case of Anonymous’s “Operation KKK” (#OpKKK), an online hacktivist campaign to expose Ku Klux Klan members carried out in support of #BlackLivesMatter protesters in Ferguson, Missouri, in November 2014, and we use social media data to show that, while BLM and Anonymous networks temporarily coordinated during the protests, there is no subsequent evidence of long-term coordination.

RBP: a website fingerprinting obfuscation method against intelligent fingerprintingattacks

A significant danger to website privacy and web security is posed by website fingerprinting (WF), a passive traffic analysis attack. It gathers the network packets created when a user accesses a website and then employs a number of approaches to identify patterns in the network packets that can be used to determine the kind of website the user is accessing. Numerous anonymous networks, like Tor, can satisfy the need to conceal identify from users while participating in network activities, but they are also vulnerable to WF assaults. In this research, we present Random Bidirectional Padding, a website fingerprinting obfuscation technique against sophisticated fingerprinting techniques (RBP). It is a cutting-edge website fingerprinting defence technology built on time sampling and random bidirectional packet padding that can change real packet distribution to destroy Inter-Arrival Time (IAT) features in the traffic sequence and increase the difference between datasets with random bidirectional virtual packet padding. We test the efficiency of thedefence against cutting-edge website fingerprinting attacks in actual circumstances.

FlowTracker: Improved flow correlation attacks with denoising and contrastive learning

Tor is the most widely used anonymous network which provides anonymity by using proxy nodes to route data. However, many researches have proved that flow correlation attacks can break the anonymity of users’ communication relationships: once attackers have access to the ingress and egress traffic flows at both ends of the network, they will find the specific user who is visiting a monitored Internet service by observing the traffic shape. Existing flow correlation attacks have limited effects because of insufficient traffic shape features, network noise influence and lack of differentiated learning on unrelated flows. In this paper, we propose an improved flow correlation attacking model named FlowTracker which contains four modules: In flow cumulative representation module, raw and normalized cumulative sequences are combined to construct robust traffic shape features. In noise resistant mapping module, stacked auto-encoders are adopted to learn the mapping relationship between related ingress and egress cumulative representations and filter out the network noise. Moreover, we leverage contrast learning in distance optimization module to generate the optimized representation in which difference between unrelated representations is amplified, further reducing the false correlation rate with similar but unrelated flows. Finally, the target flow is reported through a multi-layer decision process in the hierarchical judgment module. We evaluate FlowTracker and other advanced comparison methods on the public and self-built datasets with the more realistic unidirectional setting, experiment results demonstrate that FlowTracker has the highest attacking success rate under general and targeted scenarios, especially when the traffic shape is seriously destroyed by traffic obfuscation.

Quantum-safe Anonymous Hierarchical Identity-Based Encryption with Traceable Identities

Anonymous Identity Based Encryption (AIBET) scheme allows a tracer to use the tracing key to reveal the recipient’s identity from the ciphertext while keeping other data anonymous. This special feature makes AIBET a promising solution to distributed IoT data security since it can preserve both the privacy and the anonymity of a communication network but still give the server the ability to revoke the anonymity of some specific users in necessary situations (such as when their illegal behavior are detected). In this paper, we construct an efficient quantum-safe Hierarchical Identity-Based cryptosystem with Traceable Identities (AHIBET) with fully anonymous ciphertexts. We prove the security of our AHIBET scheme under the Learning with Errors (LWE) problem in the standard model.

Erratum: Examining the correctness of anonymity for practical quantum networks [Phys. Rev. A 101, 062311 (2020)

Erratum: Examining the correctness of anonymity for practical quantum networks [Phys. Rev. A 101, 062311 (2020)

Sliding window based ON/OFF flow watermarking on Tor

To analyze traffic in the anonymity network, an active network flow watermark scheme, the ON/OFF watermarking, is proposed to embed timing information into the network flow. This scheme exploits a technique that drops packets at prescribed time intervals to create a watermark sequence at the sending side of a flow, then extracts inter-packet delay at the receiving side, and computes the L1 distance between generated sequences to identify the network flow. A sliding window based L1 distance computation algorithm is proposed to detect flow watermark at a low overhead. Experimental results demonstrate that this timing-based flow watermarking scheme can identify watermarks efficiently and is resistant to timing disturbances in Tor.

A deep learning‐based framework to identify and characterise heterogeneous secure network traffic

AbstractThe evergrowing diversity of encrypted and anonymous network traffic makes network management more formidable to manage the network traffic. An intelligent system is essential to analyse and identify network traffic accurately. Network management needs such techniques to improve the Quality of Service and ensure the flow of secure network traffic. However, due to the usage of non‐standard ports and encryption of data payloads, the classical port‐based and payload‐based classification techniques fail to classify the secured network traffic. To solve the above‐mentioned problems, this paper proposed an effective deep learning‐based framework employed with flow‐time‐based features to predict heterogeneous secure network traffic best. The state‐of‐the‐art machine learning strategies (C4.5, random forest, and K‐nearest neighbour) are investigated for comparison. The proposed 1D‐CNN model achieved higher accuracy in classifying the heterogeneous secure network traffic. In the next step, the proposed deep learning model characterises the major categories (virtual private network traffic, the onion router network traffic, and plain encrypted network traffic) into several application types. The experimental results show the effectiveness and feasibility of the proposed deep learning framework, which yields improved predictive power compared to the state‐of‐the‐art machine learning techniques employed for secure network traffic analysis.

A distributed counting architecture for exploring the structure of anonymous active–passive networks

Active–passive networks are composed of nodes that meet specific criteria depending on applications (active nodes) and nodes that do not (passive nodes). This paper investigates the network size estimation problem, which involves determining the number of active nodes in anonymous active–passive networks in a distributed way. To this end, a distributed counting architecture is proposed to locally manipulate the criteria for being an active node via a variable and to count the number of active nodes, where this is accomplished without prior knowledge of the network or a procedure for initialization. Several properties of an anonymous network such as network size, number of nodes for a given degree, the maximum and minimum degrees, and so on, can be deduced using the proposed architecture by varying the criteria variable. Stability and convergence analysis of the proposed architecture are presented, and its effectiveness is also demonstrated through a numerical example.

QDRL: QoS-Aware Deep Reinforcement Learning Approach for Tor's Circuit Scheduling

Tor is a popular anonymity network adopted by more than two million users to preserve their privacy. Tor was mainly developed as a low-latency network to support interactive web browsing and messaging applications. However, bandwidth acquisitive applications such as BitTorrent consume a considerable percentage of Tor traffic. This results in an unfair allocation of the available bandwidth and significant degradation in the Quality-of-service (QoS) delivered to users. This paper presents a QoS-aware deep reinforcement learning approach for Tor's circuit scheduling (QDRL). We propose a design that coalesces the two scheduling levels originally presented in Tor and addresses it as a single resource allocation problem. We use the QoS requirements of different applications to set the weight of active circuits passing through a relay. Furthermore, we propose a set of approaches to achieve the optimal trade-off between system fairness and efficiency. We designed and implemented a reinforcement-learning-based scheduling approach ( <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">TRLS</i> ), a convex-optimization-based scheduling approach ( <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">CVX-OPT</i> ), and an average-rate-based proportionally fair heuristic ( <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">AR-PF</i> ). We also compare the proposed approaches with basic heuristics and with the implemented scheduler in Tor. We show that our reinforcement-learning-based approach (TRLS) achieved the highest QoS-aware fairness level with a resilient performance to the changes in an environment with a dynamic nature, such as the Tor network.

Accountable Private Set Cardinality for Distributed Measurement

We introduce cryptographic protocols for securely and efficiently computing the cardinality of set union and set intersection. Our private set-cardinality protocols ( PSC ) are designed for the setting in which a large set of parties in a distributed system makes observations, and a small set of parties with more resources and higher reliability aggregates the observations. PSC allows for secure and useful statistics gathering in privacy-preserving distributed systems. For example, it allows operators of anonymity networks such as Tor to securely answer the questions: How many unique users are using the network? and How many hidden services are being accessed? We prove the correctness and security of PSC in the Universal Composability framework against an active adversary that compromises all but one of the aggregating parties. Although successful output cannot be guaranteed in this setting, PSC either succeeds or terminates with an abort, and we furthermore make the adversary accountable for causing an abort by blaming at least one malicious party. We also show that PSC prevents adaptive corruption of the data parties from revealing past observations, which prevents them from being victims of targeted compromise, and we ensure safe measurements by making outputs differentially private. We present a proof-of-concept implementation of PSC and use it to demonstrate that PSC operates with low computational overhead and reasonable bandwidth. It can count tens of thousands of unique observations from tens to hundreds of data-collecting parties while completing within hours. PSC is thus suitable for daily measurements in a distributed system.

The Complexity of the Distributed Constraint Satisfaction Problem

We study the complexity of the Distributed Constraint Satisfaction Problem (DCSP) on a synchronous, anonymous network from a theoretical standpoint. In this setting, variables and constraints are controlled by agents which communicate with each other by sending messages through fixed communication channels. Our results endorse the well-known fact from classical CSPs that the complexity of fixed-template computational problems depends on the template’s invariance under certain operations. Specifically, we show that DCSP(Γ) is polynomial-time tractable if and only if Γ is invariant under symmetric polymorphisms of all arities. Otherwise, there are no algorithms that solve DCSP(Γ) in finite time. We also show that the same condition holds for the search variant of DCSP. Collaterally, our results unveil a feature of the processes’ neighbourhood in a distributed network, its iterated degree, which plays a major role in the analysis. We explore this notion establishing a tight connection with the basic linear programming relaxation of a CSP.

Moby: A Blackout-Resistant Anonymity Network for Mobile Devices

Internet blackouts are challenging environments for anonymity and censorship resistance. Existing popular anonymity networks (e.g., Freenet, I2P, Tor) rely on Internet connectivity to function, making them impracticable during such blackouts. In such a setting, mobile ad-hoc networks can provide connectivity, but prior communication protocols for ad-hoc networks are not designed for anonymity and attack resilience. We address this need by designing, implementing, and evaluating Moby, a blackout-resistant anonymity network for mobile devices. Moby provides end-to-end encryption, forward secrecy and sender-receiver anonymity. It features a bi-modal design of operation, using Internet connectivity when available and ad-hoc networks during blackouts. During periods of Internet connectivity, Moby functions as a regular messaging application and bootstraps information that is later used in the absence of Internet connectivity to achieve secure anonymous communications. Moby incorporates a model of trust based on users’ contact lists, and a trust establishment protocol that mitigates flooding attacks. We perform an empirically informed simulation-based study based on cellphone traces of 268,596 users over the span of a week for a large cellular provider to determine Moby’s feasibility and present our findings. Last, we implement and evaluate the Moby client as an Android app.

SQRT: A Secure Querying Scheme of Routing Table Based on Oblivious Transfer

The user equipment and directory server stay in the state of asymmetric information in anonymous networks, so that it is hard to coordinate information leakage prevention and information sharing when we explore the routing addressing technology. The severe security risk faced by existing anonymous networks, such as Tor and I2P, is the leakage of privacy information of routing nodes. This paper tries to resolve this problem and proposes a novel secure querying scheme of the routing table (SQRT) based on oblivious transfer, which can effectively ensure that both user equipment and directory server faithfully follow the routing querying protocol and protect the privacy information of both parties to the greatest extent. The SQRT scheme can realize that the directory server cannot only send the required routing nodes to the user equipment, but can also ensure that the directory server cannot know the exact routing nodes received by the user equipment and protect the information of other routing nodes in the directory server from disclosure. Security analysis shows that in the scenario where the directory server and user equipment are semi-honest, respectively, the SQRT scheme can ensure the privacy of both directory server and user equipment. The experimental simulation results show that compared with existing schemes, the SQRT scheme has obvious performance advantages in terms of the degree of anonymity, protocol running time, and communication traffic.

A Traffic Splitting Algorithm for Load Balancing in Tor.

As the most popular anonymous communication system, Tor provides anonymous protection for users by sending their messages through a series of relays. Due to the use of the bandwidth-weighted path selection algorithm, many more users choose routers with high bandwidth as relays. This will cause the utilization of high bandwidth routers to be much higher than that of low bandwidth routers, which will bring congestion risk. The Quality of Service (QoS) is difficult to guarantee for users who need delay-sensitive services such as web browsing and instant messaging. To reduce the average load of routers and improve the network throughput, we propose a circuit construction method with multiple parallel middle relays and conduct a dynamic load allocation method. The experiment demonstrates that our proposed method can provide better load balancing. Compared with other multipath anonymous communication networks, our proposed method can provide better anonymity.

Design and Analysis of a Provable Secure Two-Factor Authentication Protocol for Internet of Things

Because sensor nodes are deployed in public areas, these sensors are easy to capture by adversaries. Once a sensor is stolen, the sensitive information stored in it is likely to be exposed. Accordingly, designing a secure authentication protocol should consider this issue. Sadri et al. recently proposed a two-factor authentication protocol with anonymity for wireless sensor networks. Unfortunately, we found that their protocol had a design flaw in the user and sensor authentication phase. Besides, their protocol can not resist stolen smart card attacks, sensor capture attacks, and user impersonation attacks. In addition, their protocol does not provide perfect forward security. This paper proposes a provably secure authentication to overcome these weaknesses and flaws. By comparing the security and performance of the proposed protocol with other related protocols, we find that our work has reasonable computation overhead and better security.

Blockchain-Enabled Privacy-Preserving Access Control for Data Publishing and Sharing in the Internet of Medical Things

Recently, the rapid developments in the Internet of Medical Things (IoMT) enable smart devices to generate and transmit massive personal electronic medical records (EMRs). However, there are many sensitive attributes in an EMR, which could be accessed by external or internal unauthorized users for malicious purposes. In this article, we present a triple subject purpose-based access control (TS-PBAC) model, which is compatible with a blockchain-enabled reliable transaction network, and design an individual-centric security and privacy-preserving mechanism for access control with different purposes and roles in IoMT scenarios. Specifically, we design hierarchical purpose tree (HPT) and related policies to guarantee the legality of an external user with different purposes. To improve the privacy for sensitive attributes against an internal attacker, we design a local differential privacy (LDP)-based policy and role-based access control scheme in an edge computing paradigm to grant fine-granularity rights for authorized users. In addition, we introduce mutual evaluation metrics to evaluate data quality from a patient-and-medical-service level in an open anonymous network, only using logs kept in the blockchain. We test our approach by real-world EMRs with 100000 patients. The experimental results show that the proposed privacy-preserving scheme can better protect patient’s privacy than traditional access control policies in IoMT environments, and can make reliable and stable access control decisions between data publishers and data requesters with different purposes.