利用战略连接迁移驱动的流量分流保护隐私
Leveraging strategic connection migration-powered traffic splitting for privacy
摘要：
网络级攻击者已经开发出越来越复杂的技术来监视和控制用户的网络流量。在本文中，我们利用我们的观察，许多加密协议连接不再与设备IP地址绑定（例如，QUIC中的连接迁移功能，或WireGuard和Mosh中的IP漫游），这是由于移动优先世界中对性能的需求。我们设计并实现了一个新的框架，连接迁移供电分裂（CoMPS），利用这些性能功能，以提高用户隐私。借助CoMPS，我们可以在会话中跨网络路径和异构网络协议拆分流量。这种流量分割通过限制网络级攻击者可以观察到的流量来降低他们执行流量分析攻击的能力。我们使用CoMPS构建一个网站指纹防御，是由一个强大的自适应对手在开放世界的设置对流量分析攻击的弹性。我们评估我们的系统使用模拟分裂数据和现实世界的交通，积极分裂使用CoMPS。在我们的真实世界实验中，CoMPS将VarCNN的精确度和召回率分别降低到29.9%和36.7%，在开放世界设置中有100个监控类。CoMPS不仅可以立即部署到任何支持连接迁移的未经更改的服务器上，而且开销很小，吞吐量仅减少5- 20%。
英文摘要：
Network-level adversaries have developed increasingly sophisticated techniques to surveil and control users' network traffic. In this paper, we exploit our observation that many encrypted protocol connections are no longer tied to device IP address (e.g., the connection migration feature in QUIC, or IP roaming in WireGuard and Mosh), due to the need for performance in a mobile-first world. We design and implement a novel framework, Connection Migration Powered Splitting (CoMPS), that utilizes these performance features for enhancing user privacy. With CoMPS, we can split traffic mid-session across network paths and heterogeneous network protocols. Such traffic splitting mitigates the ability of a network-level adversary to perform traffic analysis attacks by limiting the amount of traffic they can observe. We use CoMPS to construct a website fingerprinting defense that is resilient against traffic analysis attacks by a powerful adaptive adversary in the open-world setting. We evaluate our system using both simulated splitting data and real-world traffic that is actively split using CoMPS. In our real-world experiments, CoMPS reduces the precision and recall of VarCNN to 29.9% and 36.7% respectively in the open-world setting with 100 monitored classes. CoMPS is not only immediately deployable with any unaltered server that supports connection migration, but also incurs little overhead, decreasing throughput by only 5-20%.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
