Anonymous Traces Research Articles

A blind flow fingerprinting and correlation method against disturbed anonymous traffic based on pattern reconstruction

Tor is the most widely used anonymous communication system at present which can anonymize users’ network behavior. At the same time, many illegal network activities also appear more frequently with the help of Tor, posing serious challenges for cyberspace security. Therefore, flow fingerprinting and flow correlation analysis methods are put forward to de-anonymize the malicious anonymous behaviors, which utilize external traffic features as the side-channel information. However, the adversary often reduces the ability of above two methods by adding the disturbance to the anonymous traffic. As a countermeasure against the interference, disturbance-resistant analysis methods can effectively identify those adversarial behaviors while knowing how the traffic is modified. However, in real scenarios, it is unrealistic to distinguish between disturbed and non-disturbed anonymous traffic, let alone to have a clear grasp of the disturbing strategy. In this paper, we propose a blind anonymous traffic analysis method called Blind Analyzer based on pattern reconstruction skills in a “masking-generation” manner. Specifically, Blind Analyzer extracts the pattern knowledge from non-disturbed traffic samples by masking and reconstructing them. During the method application, disturbed anonymous traces are processed following the same way, aiming at removing the incremental noise at the masking stage and restoring the original shape at the reconstruction stage. Besides, a conditional discriminator is designed to determine whether the generated sample has obvious class characteristics. Benefited from the proposed method, we can improve the effectiveness of the anonymous network behavior analysis since the disturbed traffic can be restored as normal ones accurately enough. Experiment results on three datasets show that reconstructed traffic samples output by Blind Analyzer are more useful for base analysis models, which improve the corresponding metric values by 11.23% and 6.61% in max for flow fingerprinting and correlation tasks, respectively.

Joint Alignment Networks For Few-Shot Website Fingerprinting Attack

Abstract Website fingerprinting (WF) attacks based on deep neural networks pose a significant threat to the privacy of anonymous network users. However, training a deep WF model requires many labeled traces, which can be labor-intensive and time-consuming, and models trained on the originally collected traces cannot be directly used for the classification of newly collected traces due to the concept drift caused by the time gap in the data collection. Few-shot WF attacks are proposed for using the originally and few-shot newly collected labeled traces to facilitate anonymous trace classification. However, existing few-shot WF attacks ignore the fine-grained feature alignment to eliminate the concept drift in the model training, which fails to fully use the knowledge of labeled traces. We propose a novel few-shot WF attack called Joint Alignment Networks (JAN), which conducts fine-grained feature alignment at both semantic-level and feature-level. Specifically, JAN minimizes a distribution distance between originally and newly collected traces in the feature space for feature-level alignment, and utilizes two task-specific classifiers to detect unaligned traces and force these traces mapped within decision boundaries for semantic-level alignment. Extensive experiments on public datasets show that JAN outperforms the state-of-the-art few-shot WF methods, especially in the difficult 1-shot tasks.

Designing a Location Trace Anonymization Contest

For a better understanding of anonymization methods for location traces, we have designed and held a location trace anonymization contest that deals with a long trace (400 events per user) and fine-grained locations (1024 regions). In our contest, each team anonymizes her original traces, and then the other teams perform privacy attacks against the anonymized traces. In other words, both defense and attack compete together, which is close to what happens in real life. Prior to our contest, we show that re-identification alone is insufficient as a privacy risk and that trace inference should be added as an additional risk. Specifically, we show an example of anonymization that is perfectly secure against re-identification and is not secure against trace inference. Based on this, our contest evaluates both the re-identification risk and trace inference risk and analyzes their relationship. Through our contest, we show several findings in a situation where both defense and attack compete together. In particular, we show that an anonymization method secure against trace inference is also secure against re-identification under the presence of appropriate pseudonymization. We also report defense and attack algorithms that won first place, and analyze the utility of anonymized traces submitted by teams in various applications such as POI recommendation and geo-data analysis.

Introduction: Form and Medium

Introduction: Form and Medium

Asynchronous side information attack from the edge: an approach to identify participants from anonymous mobility traces

With the increasing adoption of location-based social network applications, a large number of location traces of human mobility have been collected and published for the purpose of assisting mobile system design and scientific research. Most mobility traces are processed to achieve anonymity before publishing by the way of replacing the true IDs and introducing noise interference. In this paper, we show that such anonymous mobility traces are vulnerable to asynchronous side information attack from the edge: if partial movement information is exposed to some compromised edge nodes even after the data collection period, the adversary is able to identify the participant from the anonymous mobility traces with high probability. Our method to identify participants is based on exploring the accumulative temporal and spatial characteristics of individual movement. We introduce \(\delta\)-partition to divide user locations into sub-areas, and \(\epsilon\)-partition to group user activities into time intervals. We illustrate that a mobility trace can be uniquely represented by a set of frequent locations together with their active time intervals. We further derive a similarity measurement to be used by the adversary for asynchronous side information attack. We develop theoretical analysis to prove that an anonymous participant can be correctly identified with high probability under certain condition. Extensive experiments are conducted on three typical mobility datasets corresponding to the movement of bus, taxi and human, which show that the identification success ratio achieves 99%, 45% and 72%, respectively.

Did they login?

Researchers studying user behaviors in online communities often conduct analyses of user interaction data recorded in system logs e.g., an edit in Wikipedia. Such analysis relies on collating interactions by a unique identifier such as a user ID. However, if users can contribute without being logged-in (i.e., anonymously) analysis of interaction data omit part of a user's experience. Problematically, anonymous traces are unlikely to be randomly distributed, so their omission can change statistical conclusions, with implications for both research and practice. To understand the impacts on conclusions of leaving out anonymous traces, we conducted an analysis of system logs from two online citizen science projects. Attributing anonymous traces with user IDs, we found that (1) many users contribute anonymously, though with varied patterns; and (2) attributing anonymous traces diminishes empirical evidence used to support theory and change the results of system algorithms. These results suggest anonymous traces have implications for research on user behaviors and the practices associated with using such data to tailor user experiences in online communities.

Demographic Characterization of Anonymous Trace Travel Data

Research was undertaken to determine whether demographic characteristics of individual travelers could be derived from travel pattern information when no information about the individual was available. This question is relevant in the context of anonymously collected travel information, such as cell phone traces, when used for travel demand modeling. Determining the demographics of a traveler from such data could partially obviate the need for large-scale collection of travel survey data, depending on the purpose for which the data were to be used. This research complements methodologies used to identify activity stops, purposes, and mode types from raw trace data and presumes that such methods exist and are available. The paper documents the development of procedures for taking raw activity streams estimated from GPS trace data and converting these into activity travel pattern characteristics that are then combined with basic land use information and used to estimate various models of demographic characteristics. The work status, education level, age, and license possession of individuals and the presence of children in their households were all estimated successfully with substantial increases in performance versus null model expectations for both training and test data sets. The gender, household size, and number of vehicles proved more difficult to estimate, and performance was lower on the test data set; these aspects indicate overfitting in these models. Overall, the demographic models appear to have potential for characterizing anonymous data streams, which could extend the usability and applicability of such data sources to the travel demand context.

Anonymous trace and revoke

A broadcast encryption (BE) scheme is a method for encrypting messages in a way that only a set of privileged users can decrypt it. Anonymity in a BE system is to hide any information on the privileged set. This problem has very recently had some attention and some constructions are proposed to achieve anonymity. However, anonymity in a trace and revoke (TR) scheme has not been studied yet, and to the best of our knowledge there is no construction for an anonymous TR system. In this paper, we present a generic transformation from an anonymous BE scheme into an anonymous TR scheme.

Privacy Vulnerability of Published Anonymous Mobility Traces

Mobility traces of people and vehicles have been collected and published to assist the design and evaluation of mobile networks, such as large-scale urban sensing networks. Although the published traces are often made anonymous in that the true identities of nodes are replaced by random identifiers, the privacy concern remains. This is because in real life, nodes are open to observations in public spaces, or they may voluntarily or inadvertently disclose partial knowledge of their whereabouts. Thus, snapshots of nodes' location information can be learned by interested third parties, e.g., directly through chance/engineered meetings between the nodes and their observers, or indirectly through casual conversations or other information sources about people. In this paper, we investigate how an adversary, when equipped with a small amount of the snapshot information termed as side information, can infer an extended view of the whereabouts of a victim node appearing in an anonymous trace. Our results quantify the loss of victim nodes' privacy as a function of the nodal mobility, the inference strategies of adversaries, and any noise that may appear in the trace or the side information. Generally, our results indicate that the privacy concern is significant in that a relatively small amount of side information is sufficient for the adversary to infer the true identity (either uniquely or with high probability) of a victim in a set of anonymous traces. For instance, an adversary is able to identify the trace of 30%-50% of the victims when she has collected 10 pieces of side information about a victim.

SWP2P: P2P Anonymous Trace System based on Superposition Watermarking

A lot of attention has been paid to anonymity due to the users’ privacy protection. While peer-topeer (P2P) networks need anonymity capacity, the authority also requires partner traceability to prevent anonymous abuse. So there is a challenge to harmonize the dilemma between the anonymity and authentication in P2P networks. Few P2P protocol provides complete anonymity as well as traceability. In this paper, we propose a security mechanism to ensure anonymity for honest peers and traceability for misbehaving peers in P2P systems. We utilize superposition watermarking based anonymity trace scheme to resolve the conflicts between traceability and anonymity. This scheme uses information processing technology similar to CDMA to superpose path information. Security analysis and simulation result show that the superposition watermarking based P2P anonymity trace scheme (SWP2P) can attain tradeoff between anonymity and traceability perfectly.

Comparing traffic classifiers

Many reputable research groups have published several interesting papers on traffic classification, proposing mechanisms of different nature. However, it is our opinion that this community should now find an objective and scientific way of comparing results coming out of different groups. We see at least two hurdles before this can happen. A major issue is that we need to find ways to share full-payload data sets, or, if that does not prove to be feasible, at least anonymized traces with complete application layer meta-data. A relatively minor issue refers to finding an agreement on which metric should be used to evaluate the performance of the classifiers. In this note we argue that these are two important issues that the community should address, and sketch a few solutions to foster the discussion on these topics.