[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
[freehaven-cvs] r1757: initial references and notes on some papers for correlation (in doc/trunk: . correlation07 pingers)
Author: nickm
Date: 2007-01-24 03:21:28 -0500 (Wed, 24 Jan 2007)
New Revision: 1757
Added:
doc/trunk/correlation07/
doc/trunk/correlation07/notes.txt
doc/trunk/correlation07/traffic.bib
Modified:
doc/trunk/
doc/trunk/pingers/echolot.pdf
Log:
r12026@Kushana: nickm | 2007-01-24 03:21:20 -0500
initial references and notes on some papers for correlation paper. more notes tomorrow: typing from handwritten notes
Property changes on: doc/trunk
___________________________________________________________________
svk:merge ticket from /freehaven-doc/trunk [r12026] on c95137ef-5f19-0410-b913-86e773d04f59
Added: doc/trunk/correlation07/notes.txt
===================================================================
--- doc/trunk/correlation07/notes.txt 2006-12-07 03:22:37 UTC (rev 1756)
+++ doc/trunk/correlation07/notes.txt 2007-01-24 08:21:28 UTC (rev 1757)
@@ -0,0 +1,59 @@
+
+Notes on papers in traffic.bib, with an eye to enumerating all the attacks,
+figuring out how they work, and figuring out what we don't yet know.
+
+
+Hey, authors!
+
+If you happen to be reading this and I call some aspect of your paper 'vague'
+or 'unclear', that means that I don't understand it yet. My problem, not
+yours--but feel free to clarify for my benefit. ;)
+
+
+
+"Traffic analysis of Continuous-time mixes"
+Danezis, PET 2004, pp. 35-50
+
+ATTACK #1: mathy.
+Uses known delay characteristics of mixes (expressed as time-invariant
+probability distribution for delay) to compute probability distributions for
+how an input signal will look as it leaves a mix. Compute maximum likelihood
+for output signals, given input. Compare.
+
+ATTACK #2: In simulation: Uses click-based simulator, a confusing background
+("noise") function, and a vague source "400 packets over 10000 ticks", and an
+unclear comparison metric. "No attempt to model the noise."
+
+Neat idea: If we have full network view and we don't know if O1 or O2 is the
+output, see if any of their inputs looks like the expected 2nd-to-last view
+of the signal.
+
+Email George to see if he still has the code here.
+
+There doesn't seem to be a numerical indication of results or level of
+success?
+
+Target system seems to be SG-like.
+
+
+"On Flow Correlation Attacks and Countermeasures in Mix Networks"
+- Zhu, Fu, Graham, Bettati, and Zhao.
+PET 2004, pp 207-225.
+
+Attack: against a mix (batch or timed). Pool mixes are mentioned but not
+investigated. Transform in/out streams into rates, in buckets, with each
+in/out pair corresponding to a mix firing. Compute similarity based on
+estimated mutual information OR on an FFT/Wavelet transform plus a "Matched
+Filter Detector."
+
+Simulation: Separate one FTP stream from one (not specified AFAICT) noise
+generator. Done at packet level with TCP; not totally realistic.
+
+Matched filter seems to work better.
+
+Proposed defense: output traffic control: dummy traffic triggered by QOS
+issues. Doesn't seem to examine overhead.
+
+Most crucial details are described in TR2003-8-9, which doesn't seem to be
+online. Asked Riccardo for a copy on 6 Dec; no link received yet.
+
Added: doc/trunk/correlation07/traffic.bib
===================================================================
--- doc/trunk/correlation07/traffic.bib 2006-12-07 03:22:37 UTC (rev 1756)
+++ doc/trunk/correlation07/traffic.bib 2007-01-24 08:21:28 UTC (rev 1757)
@@ -0,0 +1,367 @@
+%
+%
+% HEY YOU!
+%
+%
+%
+% THIS IS NOT THE BIBLIOGRAPHY FOR THE PAPER!
+%
+%
+%
+% I'm using this file to keep track of my progress working through a big
+% list of traffic analysis papers. Please don't add or remove any papers
+% here! Put them in another .bib file.
+%
+%
+%
+% Yrs,
+%
+% -Nick
+%
+%
+%
+%
+%
+
+@string{fp = "Fingerprinting"}
+@string{ct = "Continuous-time traffic analysis"}
+@string{unc = "Unclassified"}
+
+% HAVE SCANNED: PET2002-2006.
+% FC2001-2005.
+% WPES2002,2003,2005
+% ESORICS2000,2002,2004,2005
+% IH2002,2004,2005
+
+% GET: FC, IEEE S&P, USENIX SECURITY, NDSS,
+
+
+% READ TOCS from: ESORICS, INFOHIDING, IEEE S&P, USENIX SECURITY, NDSS,
+% PET 2002 and earlier.
+
+
+% Y. Zhu, Xinwen Fu, R. Bettati, Wei Zhao, ``Anonymity Analysis of Mix
+% Networks against Flow-Correlation Attacks,'' Proceedings of IEEE Globecom
+%% Computer and Network Security, St. Louis, MO, November 2005. ( pdf )
+% http://faculty.cs.tamu.edu/bettati/Papers/Globecom05/globecom05.pdf
+
+
+@inproceedings{pet05-bissias,
+ author = {George Dean Bissias and Marc Liberatore and Brian Neil Levine},
+ title = {Privacy Vulnerabilities in Encrypted HTTP Streams},
+ booktitle = {Proceedings of Privacy Enhancing Technologies workshop (PET 2005)},
+ month = {May},
+ year = {2005},
+ www_section = fp,
+ www_pdf_url = "http://prisms.cs.umass.edu/brian/pubs/bissias.liberatore.pet.2005.pdf";
+}
+
+@inproceedings{pet05-zhu,
+ author = {Ye Zhu and Ricardo Bettati},
+ title = {Unmixing Mix Traffic},
+
+ booktitle = {Proceedings of Privacy Enhancing Technologies workshop (PET 2005)},
+ month = {May},
+ year = {2005},
+ www_section = traffic,
+ www_pdf_url = {http://petworkshop.org/2005/workshop/talks/zhubettatiPET2005.pdf}
+}
+
+@InProceedings{danezis:pet2004,
+ author = {George Danezis},
+ title = {The Traffic Analysis of Continuous-Time Mixes},
+ booktitle = {Proceedings of Privacy Enhancing Technologies workshop (PET 2004)},
+ year = {2004},
+ month = {May},
+ series = {LNCS},
+ volume = {3424},
+ www_section = ct,
+ www_important = {1},
+ www_pdf_url = "http://www.cl.cam.ac.uk/users/gd216/cmm2.pdf";,
+}
+
+@InProceedings{flow-correlation04,
+ author = {Ye Zhu and Xinwen Fu and Bryan Graham and Riccardo Bettati and Wei Zhao},
+ title = {On Flow Correlation Attacks and Countermeasures in Mix Networks},
+ booktitle = {Proceedings of Privacy Enhancing Technologies workshop (PET 2004)},
+ year = {2004},
+ month = {May},
+ series = {LNCS},
+ volume = {3424},
+ www_section = ct,
+ www_pdf_url = "http://students.cs.tamu.edu/xinwenfu/paper/PET04.pdf";,
+}
+
+% NOT IN ANONBIB
+@TechReportInProceedings{correlation-attacks03,
+ author = {Ye Zhu and Xinwen Fu and Bryan Graham and Riccardo Bettati and Wei Zhao},
+ title = {Correlation Attacks in a mix network},
+ year = {2003},
+ institution = {Texas A&M University Computer Science Department}
+ type = {Technical Report}
+ volume = {TR2003-8-9},
+ www_section = ct,
+ notes = {Doesn't seem to exist on the TAMU CS department's TR page.}
+}
+
+@InProceedings{TH04,
+ author = {Gergely T\'oth and Zolt\'an Horn\'ak},
+ title = {Measuring Anonymity in a Non-adaptive, Real-time System},
+ booktitle = {Proceedings of Privacy Enhancing Technologies workshop (PET 2004)},
+ year = {2004},
+ series = {Springer-Verlag, LNCS},
+ volume = {3424},
+ pages = {226--241}
+ www_section = unc,
+ www_pdf_url = {http://home.mit.bme.hu/~tgm/phd/publikaciok/2004/pet2004/pet2004-lncs-tg.pdf}
+}
+
+% From references sections of pet2003-pet2005
+
+
+@InProceedings{SS03,
+ author = {Andrei Serjantov and Peter Sewell},
+ title = {Passive Attack Analysis for Connection-Based Anonymity Systems},
+ booktitle = {Proceedings of ESORICS 2003},
+ year = {2003},
+ month = {October},
+ www_section = traffic,
+ www_ps_url = "http://www.cl.cam.ac.uk/users/aas23/papers_aas/conn_sys.ps";,
+ www_remarks =
+{An investigation of packet counting attacks (which work best on lightly
+ loaded networks) and connection-start timing attacks.}
+}
+
+@InProceedings{onion-routing:pet2000,
+ author = {Paul Syverson and Gene Tsudik and Michael Reed
+ and Carl Landwehr},
+ title = {{Towards an Analysis of Onion Routing Security}},
+ booktitle = {Proceedings of Designing Privacy Enhancing Technologies: Workshop
+ on Design Issues in Anonymity and Unobservability},
+ year = 2000,
+ month = {July},
+ pages = {96--114},
+ editor = {H. Federrath},
+ publisher = {Springer-Verlag, LNCS 2009},
+ www_section = comm,
+ www_ps_gz_url = "http://www.onion-router.net/Publications/WDIAU-2000.ps.gz";,
+ www_important = {1},
+}
+
+
+@InProceedings{mitkuro,
+ author = {M. Mitomo and K. Kurosawa},
+ title = {{Attack for Flash MIX}},
+ booktitle = {Proceedings of {ASIACRYPT} 2000},
+ year = {2000},
+ publisher = {Springer-Verlag, LNCS 1976},
+ www_section = proofs,
+ www_html_url = "http://citeseer.nj.nec.com/450148.html";,
+}
+
+@InProceedings{wright02,
+ author = {Matthew Wright and Micah Adler and Brian Neil Levine and Clay Shields},
+ title = {An Analysis of the Degradation of Anonymous Protocols},
+ booktitle = {Proceedings of the Network and Distributed Security Symposium - {NDSS} '02},
+ year = {2002},
+ month = February,
+ publisher = {IEEE},
+ www_section = traffic,
+ www_pdf_url = "http://www.cs.umass.edu/~mwright/papers/wright-degrade.pdf";,
+}
+
+
+@InProceedings{TrafHTTP,
+ author = {Qixiang Sun and Daniel R. Simon and Yi-Min Wang and Wilf Russell and Venkata N. Padmanabhan and Lili Qiu},
+ title = {Statistical Identification of Encrypted Web Browsing Traffic},
+ booktitle = {Proceedings of the 2002 IEEE Symposium on Security and Privacy},
+ pages = {19},
+ year = {2002},
+ address = {Berkeley, California},
+ month = {May},
+ www_section = fp,
+ www_pdf_url = {ftp://ftp.research.microsoft.com/pub/tr/tr-2002-23.pdf}
+}
+
+
+@InProceedings{fu-active,
+ author = {Xinwen Fu and Bryan Graham and Riccardo Bettati and Wei Zhao},
+ title = {Active Traffic Analysis Attacks and Countermeasures},
+ booktitle = {Proceedings of the 2003 International Conference on Computer Networks and Mobile Computing},
+ year = {2003},
+ pages = {31--39},
+ www_pdf_url = {http://ieeexplore.ieee.org/iel5/8807/27858/01243024.pdf}
+}
+
+@InProceedings{fu-active,
+ author = {Xinwen Fu and Bryan Graham and Riccardo Bettati and Wei Zhao},
+ title = {Analytical and Empirical Analysis of Coutermeasures to Traffic Analysis Attacks},
+ Booktitle = {Proceedings of the 2003 International Conference on Parallel Processing}
+ year = {2003},
+ pages={483--492},
+ www_pdf_url = {http://faculty.cs.tamu.edu/bettati/Papers/icpp2003/icpp2003.pdf}
+}
+
+% NOT ON ANONBIB.
+@Misc{dai-freedom,
+ author = {Wei Dai},
+ title = {Two attacks against freedom},
+ howpublished = "Post to Cypherpunks mailing list",
+ year = 2000,
+ www_html_url = "http://eskimo.com/~eidai/freedom-attacks.txt";,
+ www_section = traffic
+}
+
+@InProceedings{rackoff93cryptographic,
+ author = {Charles Rackoff and Daniel R. Simon},
+ title = {Cryptographic Defense Against Traffic Analysis},
+ booktitle = {Proceedings of {ACM} Symposium on Theory of Computing},
+ pages = {672--681},
+ year = {1993},
+ www_section = traffic,
+% www_html_url = "http://research.microsoft.com/crypto/dansimon/me.htm";,
+% www_important = {1},
+ www_ps_url = {http://research.microsoft.com/crypto/papers/ta.ps},
+}
+
+% not in anonbib
+@InProceedings{TH06a,
+ author = {Gergely T\'oth and Zolt\'an Horn\'ak},
+ title = {The Chances of Successful Attacks Against Continuous-time
++Mixes},
+ booktitle = {Proceedings of the 11th Nordic Workshop on Secure IT Systems},
+ year = {2006},
+ address = {Link\"oping, Sweden}
+}
+
+% Read
+
+@InProceedings{langos02,
+ author = {Oliver Berthold and Heinrich Langos},
+ title = {Dummy Traffic Against Long Term Intersection Attacks},
+ booktitle = {Proceedings of Privacy Enhancing Technologies workshop (PET 2002)},
+ year = {2002},
+ month = {April},
+ editor = {Roger Dingledine and Paul Syverson},
+ publisher = {Springer-Verlag, LNCS 2482},
+ www_section = traffic,
+ www_pdf_url = "http://www.inf.fu-berlin.de/~berthold/publ/BeLa_02.pdf";,
+ notes = { Not about low-latency traffic analsis. }
+}
+
+@InProceedings{back01,
+ author = {Adam Back and Ulf M\"oller and Anton Stiglic},
+ title = {Traffic Analysis Attacks and Trade-Offs in Anonymity Providing Systems},
+ booktitle = {Proceedings of Information Hiding Workshop (IH 2001)},
+ pages = {245--257},
+ year = 2001,
+ month = "April",
+ editor = {Ira S. Moskowitz},
+ publisher = {Springer-Verlag, LNCS 2137},
+ www_section = traffic,
+ www_important = 1,
+ www_pdf_url = "http://www.cypherspace.org/adam/pubs/traffic.pdf";,
+ notes = { Vaguely describes packet counting in 6.1; doesn't seem to
+ understand that it works end-to-end.}
+}
+
+
+@InProceedings{raymond00,
+ author = {Jean-Fran\c{c}ois Raymond},
+ title = {{Traffic Analysis: Protocols, Attacks, Design Issues,
+ and Open Problems}},
+ booktitle = {Proceedings of Designing Privacy Enhancing Technologies: Workshop
+ on Design Issues in Anonymity and Unobservability},
+ year = 2000,
+ month = {July},
+ pages = {10-29},
+ editor = {H. Federrath},
+ publisher = {Springer-Verlag, LNCS 2009},
+ www_section = traffic,
+ www_important = {1},
+ www_ps_url = {http://www.geocities.com/j_f_raymond/mesarticles/berkeley_ws_lncs.ps},
+ www_pdf_url = {http://www.geocities.com/j_f_raymond/mesarticles/berkeley_ws_lncs.pdf},
+ notes = {Not terribly useful; describtes timing and volume attacks
+ only slightly. }
+}
+
+
+@InProceedings{stepping-stones,
+ author = {Xinyuan Wang and Douglas S. Reeves and S. Felix Wu},
+ title = {Inter-Packet Delay Based Coorelation for Tracing Encrypted Connections through Stepping Stones},
+ Booktitle = {Proceedings of ESORICS 2002},
+ Year = {2002},
+ month = {October},
+ pages = {244--263},
+ www_section = traffic,
+ www_pdf_url = {http://arqos.csc.ncsu.edu/papers/2002-08-esorics02-ipd-correlation.pdf}
+ notes = {Very nicely written formulation of end-to-end timing
+ correlation, with experiments and methods. Focused
+ on tracing ersatz anonymizers constructed by an
+ attacker. }
+
+}
+
+@InProceedings{disad-free-routes,
+ author = {Oliver Berthold and Andreas Pfitzmann and Ronny Standtke},
+ title = {The disadvantages of free {MIX} routes and how to overcome
+ them},
+ booktitle = {Proceedings of Designing Privacy Enhancing Technologies: Workshop
+ on Design Issues in Anonymity and Unobservability},
+ pages = {30--45},
+ month = {July},
+ year = 2000,
+ editor = {H. Federrath},
+ publisher = {Springer-Verlag, LNCS 2009},
+ www_section = traffic,
+ www_pdf_url = "http://www.tik.ee.ethz.ch/~weiler/lehre/netsec/Unterlagen/anon/disadvantages_berthold.pdf";
+% www_important = {1},
+ notes = {Nothing about how to do e2e correlation or fingerprinting.}
+}
+
+
+@InProceedings{timing-fc2004,
+ author = {Brian N. Levine and Michael K. Reiter and Chenxi Wang and Matthew K. Wright},
+ title = {Timing Attacks in Low-Latency Mix-Based Systems (Extended Abstract)},
+ booktitle = {Proceedings of Financial Cryptography (FC '04)},
+ year = {2004},
+ month = February,
+ editor = {Ari Juels},
+ publisher = {Springer-Verlag, LNCS 3110},
+ www_section = traffic,
+ www_pdf_url = "http://www.cs.umass.edu/~mwright/papers/levine-timing.pdf";,
+ notes = {Uses cross-correlation of
+ n-packets-received-in-interval. Assumes IP-like
+ traffic. Analyzes simulated results for various IP
+ trace models, along with "defensive dropping." }
+}
+
+
+@InProceedings{hintz02,
+ author = {Andrew Hintz},
+ title = {Fingerprinting Websites Using Traffic Analysis},
+ booktitle = {Proceedings of Privacy Enhancing Technologies workshop (PET 2002)},
+ year = {2002},
+ month = {April},
+ editor = {Roger Dingledine and Paul Syverson},
+ publisher = {Springer-Verlag, LNCS 2482},
+ www_section = traffic,
+ www_html_url = "http://guh.nu/projects/ta/safeweb/safeweb.html";,
+ www_pdf_url = "http://guh.nu/projects/ta/safeweb/safeweb.pdf";,
+ www_ps_url = "http://guh.nu/projects/ta/safeweb/safeweb.ps";,
+ notes = {Introduces fingerprinting. Doesn't do much statistics.}
+}
+
+
+
+@InProceedings{limits-open,
+ author = {Dogan Kesdogan and Dakshi Agrawal and Stefan Penz},
+ title = {Limits of Anonymity in Open Environments},
+ booktitle = {Proceedings of Information Hiding Workshop (IH 2002)},
+ year = {2002},
+ month = "October",
+ editor = {Fabien Petitcolas},
+ publisher = {Springer-Verlag, LNCS 2578},
+ www_section = traffic,
+ notes = {Examines the success of the (original, non-statistical) disclosure attack.}
+}
Modified: doc/trunk/pingers/echolot.pdf
===================================================================
(Binary files differ)
***********************************************************************
To unsubscribe, send an e-mail to majordomo@xxxxxxxx with
unsubscribe freehaven-cvs in the body. http://freehaven.net/