Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
skip to main content
10.1145/3559613.3563191acmconferencesArticle/Chapter ViewAbstractPublication PagesccsConference Proceedingsconference-collections
research-article

Classification of Encrypted IoT Traffic despite Padding and Shaping

Published: 07 November 2022 Publication History
  • Get Citation Alerts
  • Abstract

    It is well-known that when IoT traffic is unencrypted it is possible to identify the active devices based on their TCP/IP headers. And when traffic is encrypted, packet-sizes and timings can still be used to do so. To defend against such fingerprinting, traffic padding and shaping were introduced. In this paper we show that even with these mitigations, the privacy of IoT consumers can still be violated. The main tool we use in our analysis is the full distribution of packet-size---as opposed to commonly used statistics such as mean and variance. We evaluate the performance of a local adversary, such as a snooping neighbor or a criminal, against 8~different padding methods. We show that our classifiers achieve perfect (100% accuracy) classification using the full packet-size distribution for low-overhead methods, whereas prior works that rely on statistical metadata achieved lower rates even when no padding and shaping were used. We also achieve an excellent classification rate even against high-overhead methods. We further show how an external adversary such as a malicious ISP or a government intelligence agency, who only sees the padded and shaped traffic as it goes through a VPN, can accurately identify the subset of active devices with Recall and Precision of at least 96%. Finally, we also propose a new method of padding we call the Dynamic STP (DSTP) that incurs significantly less per-packet overhead compared to other padding methods we tested and guarantees more privacy to IoT consumers.

    References

    [1]
    Abbas Acar, Hossein Fereidooni, Tigist Abera, Amit Kumar Sikder, Markus Miettinen, Hidayet Aksu, Mauro Conti, Ahmad-Reza Sadeghi, and Selcuk Uluagac. 2020. Peek-a-Boo: I See Your Smart Home Activities, Even Encrypted!. In Proceedings of the 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec '20). Association for Computing Machinery, New York, NY, USA, 207--218. https://doi.org/10.1145/3395351.3399421
    [2]
    Bandar Alotaibi and Khaled Elleithy. 2016. A New MAC Address Spoofing Detection Technique Based on Random Forests. Sensors, Vol. 16, 3 (2016). https://doi.org/10.3390/s16030281
    [3]
    Ahmed Alshehri, Jacob Granley, and Chuan Yue. 2020. Attacking and Protecting Tunneled Traffic of Smart Home Devices. In Proceedings of the Tenth ACM Conference on Data and Application Security and Privacy (CODASPY '20). Association for Computing Machinery, New York, NY, USA, 259--270. https://doi.org/10.1145/3374664.3375723
    [4]
    Noah Apthorpe, Danny Huang, Dillon Reisman, Arvind Narayanan, and Nick Feamster. 2019. Keeping the Smart Home Private with Smart(er) IoT Traffic Shaping. In Proceedings on Privacy Enhancing Technologies (POPETS, Vol. 2019). 128--148. https://doi.org/10.2478/popets-2019-0040
    [5]
    Noah Apthorpe, Dillon Reisman, and Nick Feamster. 2017a. Closing the Blinds: Four Strategies for Protecting Smart Home Privacy from Network Observers. In IEEE Workshop on Technology and Consumer Protection (ConPro). San Francisco, CA, 1--6. https://www.ieee-security.org/TC/SPW2017/ConPro/papers/apthorpe-conpro17.pdf
    [6]
    Noah Apthorpe, Dillon Reisman, Srikanth Sundaresan, Arvind Narayanan, and Nick Feamster. 2017b. Spying on the Smart Home: Privacy Attacks and Defenses on Encrypted IoT Traffic. Technical Report arXiv:1708.05044 [cs.CR].
    [7]
    Noah Apthorpe, Dillon Reissman, and Nick Feamster. 2016. A Smart Home is No Castle: Privacy Vulnerabilities of Encrypted IoT Traffic. In Workshop on Data and Algorithmic Transparency (DAT). New York, NY, 1--6. http://datworkshop.org/papers/dat16-final37.pdf
    [8]
    Bruhadeshwar Bezawada, Maalvika Bachani, Jordan Peterson, Hossein Shirazi, Indrakshi Ray, and Indrajit Ray. 2018. Behavioral Fingerprinting of IoT Devices. In Proceedings of the 2018 Workshop on Attacks and Solutions in Hardware Security (Toronto, Canada) (ASHES '18). Association for Computing Machinery, New York, NY, USA, 41--50. https://doi.org/10.1145/3266444.3266452
    [9]
    Sanjit Bhat, David Lu, Albert Kwon, and Srinivas Devadas. 2019. Var-CNN: A Data-Efficient Website Fingerprinting Attack Based on Deep Learning. Proceedings on Privacy Enhancing Technologies, Vol. 2019, 4 (2019), 292--310. https://doi.org/
    [10]
    Tønnes Brekne, André Årnes, and Arne Øslebø. 2005. Anonymization of IP Traffic Monitoring Data: Attacks on Two Prefix-Preserving Anonymization Schemes and Some Proposed Remedies. In Privacy Enhancing Technologies.
    [11]
    Mauro Conti, Luigi Mancini, Riccardo Spolaor, and Nino Verde. 2015. Analyzing Android Encrypted Network Traffic to Identify User Actions. IEEE Transactions on Information Forensics and Security, Vol. 11 (01 2015), 1--1. https://doi.org/10.1109/TIFS.2015.2478741
    [12]
    Bogdan Copos, Karl Levitt, Matt Bishop, and Jeff Rowe. 2016. Is Anybody Home? Inferring Activity From Smart Home Network Traffic. In 2016 IEEE Security and Privacy Workshops (SPW). 245--251. https://doi.org/10.1109/SPW.2016.48
    [13]
    Trisha Datta, Noah Apthorpe, and Nick Feamster. 2018. A Developer-Friendly Library for Smart Home IoT Privacy-Preserving Traffic Obfuscation. In Proceedings of the 2018 Workshop on IoT Security and Privacy (Budapest, Hungary) (IoT S&P'18). Association for Computing Machinery, New York, NY, USA, 43--48. https://doi.org/10.1145/3229565.3229567
    [14]
    Shuaike Dong, Zhou Li, Di Tang, Jiongyi Chen, Menghan Sun, and Kehuan Zhang. 2020. Your Smart Home Can't Keep a Secret: Towards Automated Fingerprinting of IoT Traffic. In Proceedings of the 15th ACM Asia Conference on Computer and Communications Security (Taipei, Taiwan) (ASIA CCS'20). Association for Computing Machinery, New York, NY, USA, 47----59. https://doi.org/10.1145/3320269.3384732
    [15]
    Kevin P. Dyer, Scott E. Coull, Thomas Ristenpart, and Thomas Shrimpton. 2012. Peek-a-Boo, I Still See You: Why Efficient Traffic Analysis Countermeasures Fail. In 2012 IEEE Symposium on Security and Privacy. 332--346. https://doi.org/10.1109/SP.2012.28
    [16]
    Kiana Dziubinski and Masaki Bandai. 2021. Bandwidth Efficient IoT Traffic Shaping Technique for Protecting Smart Home Privacy from Data Breaches in Wireless LAN. IEICE Transactions on Communications (02 2021). https://doi.org/10.1587/transcom.2020EBP3182
    [17]
    Jide S. Edu, Jose M. Such, and Guillermo Suarez-Tangil. 2020. Smart Home Personal Assistants: A Security and Privacy Review. ACM Comput. Surv., Vol. 53, 6, Article 116 (dec 2020), 36 pages. https://doi.org/10.1145/3412383
    [18]
    Dominik Herrmann, Rolf Wendolsky, and Hannes Federrath. 2009. Website Fingerprinting: Attacking Popular Privacy Enhancing Technologies with the Multinomial Na"ive-Bayes Classifier. In Proceedings of the 2009 ACM Workshop on Cloud Computing Security (Chicago, Illinois, USA) (CCSW '09). Association for Computing Machinery, New York, NY, USA, 31--42. https://doi.org/10.1145/1655008.1655013
    [19]
    Arne Holst. 2021. Number of Internet of Things (IoT) connected devices worldwide from 2019 to 2030. https://www.statista.com/statistics/1183457/iot-connected-devices-worldwide/.
    [20]
    Marc Juárez, Mohsen Imani, Mike Perry, Claudia Díaz, and Matthew K. Wright. 2016. Toward an Efficient Website Fingerprinting Defense. In ESORICS.
    [21]
    Pierre-Marie Junges, Jérôme François, and Olivier Festor. 2019. Passive Inference of User Actions through IoT Gateway Encrypted Traffic Analysis. 2019 IFIP/IEEE Symposium on Integrated Network and Service Management (IM) (2019), 7--12.
    [22]
    Lillian Lee. 1999. Measures of Distributional Similarity. In Proceedings of the 37th Annual Meeting of the Association for Computational Linguistics on Computational Linguistics (College Park, Maryland) (ACL '99). Association for Computational Linguistics, USA, 25--32. https://doi.org/10.3115/1034678.1034693
    [23]
    Huchang Liao and Zeshui Xu. 2015. Approaches to manage hesitant fuzzy linguistic information based on the cosine distance and similarity measures for HFLTSs and their application in qualitative decision making. Expert Systems with Applications, Vol. 42, 12 (2015), 5328--5336. https://doi.org/10.1016/j.eswa.2015.02.017
    [24]
    Mary L. McHugh. 2013. The chi-square test of independence. Biochemia medica, Vol. 23, 2 (2013), 143--149.
    [25]
    Yair Meidan, Michael Bohadana, Asaf Shabtai, Juan David Guarnizo, Mart'in Ochoa, Nils Ole Tippenhauer, and Yuval Elovici. 2017. ProfilIoT: A Machine Learning Approach for IoT Device Identification Based on Network Traffic Analysis. In Proceedings of the Symposium on Applied Computing (SAC'17). Association for Computing Machinery, New York, NY, USA, 506--509. https://doi.org/10.1145/3019612.3019878
    [26]
    Yair Meidan, Vinay Sachidananda, Hongyi Peng, Racheli Sagron, Yuval Elovici, and Asaf Shabtai. 2020. A novel approach for detecting vulnerable IoT devices connected behind a home NAT. Computers & Security, Vol. 97 (2020), 101968. https://doi.org/10.1016/j.cose.2020.101968
    [27]
    Nizar Msadek, Ridha Soua, and Thomas Engel. 2019. IoT Device Fingerprinting: Machine Learning based Encrypted Traffic Analysis. In 2019 IEEE wireless communications and networking conference (WCNC). 1--8. https://doi.org/10.1109/WCNC.2019.8885429
    [28]
    Milad Nasr, Alireza Bahramali, and Amir Houmansadr. 2021. Defeating DNN-Based Traffic Analysis Systems in Real-Time With Blind Adversarial Perturbations. In 30th USENIX Security Symposium (USENIX Security 21). USENIX Association, 2705--2722. https://www.usenix.org/conference/usenixsecurity21/presentation/nasr
    [29]
    Nisha Panwar, Shantanu Sharma, Guoxi Wang, Sharad Mehrotra, and Nalini Venkatasubramanian. 2021. CANOPY: A Verifiable Privacy-Preserving Token Ring-Based Communication Protocol for Smart Homes. ACM Trans. Cyber-Phys. Syst., Vol. 5, 1, Article 3 (dec 2021), 34 pages. https://doi.org/10.1145/3390859
    [30]
    Roberto Perdisci, Thomas Papastergiou, Omar Alrawi, and Manos Antonakakis. 2020. IoTFinder: Efficient Large-Scale Identification of IoT Devices via Passive DNS Traffic Analysis. In 2020 IEEE European Symposium on Security and Privacy (EuroS&P). 474--489. https://doi.org/10.1109/EuroSP48549.2020.00037
    [31]
    Antônio J. Pinheiro, Jeandro M. Bezerra, and Divanilson R. Campelo. 2018. Packet Padding for Improving Privacy in Consumer IoT. In IEEE Symposium on Computers and Communications (ISCC). 925--929. https://doi.org/10.1109/ISCC.2018.8538744
    [32]
    Antônio J. Pinheiro, Jeandro de M. Bezerra, Caio A.P. Burgardt, and Divanilson R. Campelo. 2019. Identifying IoT devices and events based on packet length from encrypted traffic. Computer Communications, Vol. 144 (2019), 8--17. https://doi.org/10.1016/j.comcom.2019.05.012
    [33]
    Antônio J. Pinheiro, Paulo Freitas de Araujo-Filho, Jeandro de M. Bezerra, and Divanilson R. Campelo. 2021. Adaptive Packet Padding Approach for Smart Home Networks: A Tradeoff Between Privacy and Performance. IEEE Internet of Things Journal, Vol. 8, 5 (2021), 3930--3938. https://doi.org/10.1109/JIOT.2020.3025988
    [34]
    Geong Sen Poh, Prosanta Gope, and Jianting Ning. 2021. PrivHome: Privacy-Preserving Authenticated Communication in Smart Home Environment. IEEE Transactions on Dependable and Secure Computing, Vol. 18, 3 (2021), 1095--1107. https://doi.org/10.1109/TDSC.2019.2914911
    [35]
    Daniele Riboni, Antonio Villani, Domenico Vitali, Claudio Bettini, and Luigi V. Mancini. 2012. Obfuscation of sensitive data in network flows. 2012 Proceedings IEEE INFOCOM (2012), 2372--2380.
    [36]
    Mustafizur R. Shahid, Gregory Blanc, Zonghua Zhang, and Hervé Debar. 2018. IoT Devices Recognition Through Network Traffic Analysis. In 2018 IEEE International Conference on Big Data (Big Data). 5187--5192. https://doi.org/10.1109/BigData.2018.8622243
    [37]
    Amit Kumar Sikder, Giuseppe Petracca, Hidayet Aksu, Trent Jaeger, and A. Selcuk Uluagac. 2021. A Survey on Sensor-Based Threats and Attacks to Smart Devices and Applications. IEEE Communications Surveys Tutorials, Vol. 23, 2 (2021), 1125--1159. https://doi.org/10.1109/COMST.2021.3064507
    [38]
    Payap Sirinam, Mohsen Imani, Marc Juárez, and Matthew K. Wright. 2018. Deep Fingerprinting: Undermining Website Fingerprinting Defenses with Deep Learning. Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security (2018).
    [39]
    Arunan Sivanathan, Daniel Sherratt, Hassan Habibi Gharakheili, Adam Radford, Chamith Wijenayake, Arun Vishwanath, and Vijay Sivaraman. 2017. Characterizing and classifying IoT traffic in smart cities and campuses. In Proc. IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS). 559--564. https://doi.org/10.1109/INFCOMW.2017.8116438
    [40]
    Tim Stöber, Mario Frank, Jens Schmitt, and Ivan Martinovic. 2013. Who do you sync you are?: smartphone fingerprinting via application behaviour. In Proc. 6th ACM conference on Security and privacy in wireless and mobile networks. https://doi.org/10.1145/2462096.2462099
    [41]
    Anastasiia Strielkina, Vyacheslav Kharchenko, and Dmytro Uzun. 2018. Availability models for healthcare IoT systems: Classification and research considering attacks on vulnerabilities. In 2018 IEEE 9th International Conference on Dependable Systems, Services and Technologies (DESSERT). 58--62. https://doi.org/10.1109/DESSERT.2018.8409099
    [42]
    Haseeb Touqeer, Rashid Amin, Mudassar Hussain, Fadi Al-Turjman, and Muhammad Bilal. 2021. Smart home security: challenges, issues and solutions at different IoT layers. The Journal of Supercomputing, Vol. 77 (12 2021). https://doi.org/10.1007/s11227-021-03825--1
    [43]
    Martino Trevisan, Danilo Giordano, Idilio Drago, Marco Mellia, and Maurizio Munafo. 2018. Five Years at the Edge: Watching Internet from the ISP Network. In Proceedings of the 14th International Conference on Emerging Networking EXperiments and Technologies (Heraklion, Greece) (CoNEXT '18). Association for Computing Machinery, New York, NY, USA, 1--12. https://doi.org/10.1145/3281411.3281433
    [44]
    Rachmadi Trimananda, Janus Varmarken, Athina Markopoulou, and Brian Demsky. 2020. Packet-Level Signatures for Smart Home Devices. In Network and Distributed Systems Security (NDSS) Symposium. https://doi.org/10.14722/ndss.2020.24097
    [45]
    Mostafa Uddin, Tamer Nadeem, and Santosh Nukavarapu. 2019. Extreme SDN framework for IoT and mobile applications flexible privacy at the edge. In 2019 IEEE International Conference on Pervasive Computing and Communications (PerCom. IEEE, 1--11.
    [46]
    Ronald van Haalen and Richa Malhotra. 2007. Improving TCP performance with bufferless token bucket policing: A TCP friendly policer. In 2007 15th IEEE Workshop on Local & Metropolitan Area Networks. IEEE, 72--77.
    [47]
    Petr Velan, Milan Cermak, Pavel Celeda, and Martin Draar. 2015. A survey of methods for encrypted traffic classification and analysis. International Journal of Network Management, Vol. 25 (07 2015). https://doi.org/10.1002/nem.1901
    [48]
    Andressa Vergutz, Guevara Noubir, and Michele Nogueira. 2020. Reliability for Smart Healthcare: A Network Slicing Perspective. IEEE Network, Vol. 34, 4 (2020), 91--97. https://doi.org/10.1109/MNET.011.1900458
    [49]
    Chenggang Wang, Sean Kennedy, Haipeng Li, King Hudson, Gowtham Atluri, Xuetao Wei, Wenhai Sun, and Boyang Wang. 2020. Fingerprinting Encrypted Voice Traffic on Smart Speakers with Deep Learning. In Proceedings of the 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks (Linz, Austria) (WiSec '20). Association for Computing Machinery, New York, NY, USA, 254--265. https://doi.org/10.1145/3395351.3399357
    [50]
    Tao Wang and Ian Goldberg. 2016. On Realistically Attacking Tor with Website Fingerprinting. Proceedings on Privacy Enhancing Technologies, Vol. 2016 (02 2016). https://doi.org/10.1515/popets-2016-0027
    [51]
    Tao Wang and Ian Goldberg. 2017. Walkie-Talkie: An Efficient Defense Against Passive Website Fingerprinting Attacks. In 26th USENIX Security Symposium (USENIX Security 17). USENIX Association, Vancouver, BC, 1375--1390. https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/wang-tao
    [52]
    Cheng-Shong Wu, Ming-Hsien Hsu, and Kim-Joan Chen. 2002. Traffic shaping for TCP networks: TCP leaky bucket. In 2002 IEEE Region 10 Conference on Computers, Communications, Control and Power Engineering. TENCOM'02. Proceedings., Vol. 2. IEEE, 809--812.
    [53]
    Sijie Xiong, Anand D. Sarwate, and Narayan B. Mandayam. 2018. Defending Against Packet-Size Side-Channel Attacks in IoT Networks. In 2018 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). 2027--2031. https://doi.org/10.1109/ICASSP.2018.8461330

    Cited By

    View all
    • (2024)Survey and Experimentation to Compare IoT Device Model Identification Methods2024 IEEE 25th International Symposium on a World of Wireless, Mobile and Multimedia Networks (WoWMoM)10.1109/WoWMoM60985.2024.00014(13-17)Online publication date: 4-Jun-2024
    • (2023)DeviceGPT: A Generative Pre-Training Transformer on the Heterogenous Graph for Internet of ThingsProceedings of the 46th International ACM SIGIR Conference on Research and Development in Information Retrieval10.1145/3539618.3591972(1929-1933)Online publication date: 19-Jul-2023
    • (2023)Estimating Traffic Rates in CSMA/CA Networks: A Feasibility Analysis for a Class of EavesdroppersIEEE Transactions on Wireless Communications10.1109/TWC.2023.327355022:12(9793-9807)Online publication date: 11-May-2023
    • Show More Cited By

    Index Terms

    1. Classification of Encrypted IoT Traffic despite Padding and Shaping

        Recommendations

        Comments

        Information & Contributors

        Information

        Published In

        cover image ACM Conferences
        WPES'22: Proceedings of the 21st Workshop on Privacy in the Electronic Society
        November 2022
        227 pages
        ISBN:9781450398732
        DOI:10.1145/3559613
        Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

        Sponsors

        Publisher

        Association for Computing Machinery

        New York, NY, United States

        Publication History

        Published: 07 November 2022

        Permissions

        Request permissions for this article.

        Check for updates

        Author Tags

        1. iot devices
        2. packet-size
        3. traffic padding and shaping

        Qualifiers

        • Research-article

        Conference

        CCS '22
        Sponsor:

        Acceptance Rates

        Overall Acceptance Rate 106 of 355 submissions, 30%

        Upcoming Conference

        CCS '24
        ACM SIGSAC Conference on Computer and Communications Security
        October 14 - 18, 2024
        Salt Lake City , UT , USA

        Contributors

        Other Metrics

        Bibliometrics & Citations

        Bibliometrics

        Article Metrics

        • Downloads (Last 12 months)117
        • Downloads (Last 6 weeks)4

        Other Metrics

        Citations

        Cited By

        View all
        • (2024)Survey and Experimentation to Compare IoT Device Model Identification Methods2024 IEEE 25th International Symposium on a World of Wireless, Mobile and Multimedia Networks (WoWMoM)10.1109/WoWMoM60985.2024.00014(13-17)Online publication date: 4-Jun-2024
        • (2023)DeviceGPT: A Generative Pre-Training Transformer on the Heterogenous Graph for Internet of ThingsProceedings of the 46th International ACM SIGIR Conference on Research and Development in Information Retrieval10.1145/3539618.3591972(1929-1933)Online publication date: 19-Jul-2023
        • (2023)Estimating Traffic Rates in CSMA/CA Networks: A Feasibility Analysis for a Class of EavesdroppersIEEE Transactions on Wireless Communications10.1109/TWC.2023.327355022:12(9793-9807)Online publication date: 11-May-2023
        • (2023)Combining Stochastic and Deterministic Modeling of IPFIX Records to Infer Connected IoT Devices in Residential ISP NetworksIEEE Internet of Things Journal10.1109/JIOT.2022.322211610:6(5128-5145)Online publication date: 15-Mar-2023
        • (2023)A Survey of Traffic Shaping Technology in Internet of ThingsIEEE Access10.1109/ACCESS.2022.323339411(3794-3809)Online publication date: 2023

        View Options

        Get Access

        Login options

        View options

        PDF

        View or Download as a PDF file.

        PDF

        eReader

        View online with eReader.

        eReader

        Media

        Figures

        Other

        Tables

        Share

        Share

        Share this Publication link

        Share on social media