SiamHAN: IPv6 Address Correlation Attacks on TLS Encrypted Traffic via Siamese Heterogeneous Graph Attention Network

Autor:	Cui, Tianyu, Gou, Gaopeng, Xiong, Gang, Li, Zhen, Cui, Mingxin, Liu, Chang
Rok vydání:	2022
Předmět:	Computer Science - Cryptography and Security Computer Science - Artificial Intelligence Computer Science - Networking and Internet Architecture
Druh dokumentu:	Working Paper
Popis:	Unlike IPv4 addresses, which are typically masked by a NAT, IPv6 addresses could easily be correlated with user activity, endangering their privacy. Mitigations to address this privacy concern have been deployed, making existing approaches for address-to-user correlation unreliable. This work demonstrates that an adversary could still correlate IPv6 addresses with users accurately, even with these protection mechanisms. To do this, we propose an IPv6 address correlation model - SiamHAN. The model uses a Siamese Heterogeneous Graph Attention Network to measure whether two IPv6 client addresses belong to the same user even if the user's traffic is protected by TLS encryption. Using a large real-world dataset, we show that, for the tasks of tracking target users and discovering unique users, the state-of-the-art techniques could achieve only 85% and 60% accuracy, respectively. However, SiamHAN exhibits 99% and 88% accuracy. Comment: The paper has been accepted at the 30th USENIX Security Symposium (USENIX Security 2021). The source code has been published at https://github.com/CuiTianyu961030/SiamHAN
Databáze:	arXiv
Externí odkaz:	http://arxiv.org/abs/2204.09465 Zobrazit plný text záznamu View this record from Arxiv