Traffic Morphing: An Efficient Defense Against Statistical Traffic Analysis Charles Wright, Scott Coull, Fabian Monrose Presented by Sruthi Vemulapalli Introduction • • • • • Network traffic analysis How to reduce the leak of data? Convex optimization Examples Traffic classification techniques VoIP language classifier Web page classifier • Statistical distribution in encrypted VoIP • Mimicry attack • Polymorphic blending technique • Other approaches Traffic Morphing • Goal: To provide users with an efficient method of preventing information leakage that induces less overhead. • Operation : – Selection of source processes – Selection of target processes – Morphing Matrix – Morphing algorithm – Data interception Morphing Matrix • Source process : X = [x1, x2, . . . , xn]T, xi is the probability of the ith largest packet size • Target process : Y = [y1, y2, . . . , yn]T • Morphing Matrix A = [aij], where Y=AX Operation • Packet received from source application • Altering of packets • Cumulative probability si=sum of the probabilities for all sizes <=si • Sampling Target size • Advantage : – Minimum overhead – Matrix generation performed offline Morphing via Convex Optimization • From A we have n2 unknowns • Y=AX representation • n equations from the matrix • Another n equations • Minimizing the cost function f0(A) • Solving convex optimization functions • Example Overall cost matrix A represented as: • Optimization problem in standard form Additional Morphing Constraints • Uses: Preserve the quality of the data Minimize number of packets produced • Adding equality constraints • Disadvantage : Overspecified equations with no valid solution • Multilevel programming • Example Comparison function: First Optimization Problem: • Second Optimization Problem Dealing with Large Sample Spaces • Problem with growth of constraints Complexity of finding morphing matrices when n is large becomes prohibitively high • Divide and Conquer strategy • Applying the strategy to X and Y vectors • Example (bigram distributions) Initial morphing matrix optimization: Submatrix optimization: Practical Considerations • Short Network Sessions • Variations in Source Distribution • Reducing Packet Sizes Evaluation • Encrypted Voice over IP • Whitebox vs Blackbox Morphing • Defeating the Original Classifier • Evaluating Indistinguishability • White box has the best accuracy over black box Web Page Identification • Defeating the Original Classifier Conclusion • Traffic morphing, chooses the best way to alter the feature(s) of a packet • Privacy and efficiency are balanced through the use of convex optimization techniques • Works in real-time • Reduces the accuracy of the VoIP and webpage classifier