Privacy Vulnerabilities in Encrypted HTTP Streams

Abstract. Encrypting traffic does not prevent an attacker from performing some types of traffic analysis. We present a straightforward traffic analysis attack against encrypted HTTP streams that is surprisingly effective in identifying the source of the traffic. An attacker starts by creating a profile of the statistical characteristics of web requests from interesting sites, including distributions of packet sizes and inter-arrival times. Later, candidate encrypted streams are compared against these profiles. In our evaluations using real traffic, we find that many web sites are subject to this attack. With a training period of 24 hours and a 1 hour delay afterwards, the attack achieves only 23% accuracy. However, an attacker can easily pre-determine which of trained sites are easily identifiable. Accordingly, against 25 such sites, the attack achieves 40% accuracy; with three guesses, the attack achieves 100% accuracy for our data. Longer delays after training decrease accuracy...

• Type: Conference
• Year: 2005
• Where: PET
• Authors: George Dean Bissias, Marc Liberatore, David Jensen, Brian Neil Levine
• Keywords: Encrypted, PET 2005, Security Privacy, Statistical Characteristics, Traffic Analysis Attack