This project concerns traffic analysis--the practice of learning sensitive information from communication patterns, rather than their contents. As encryption of data becomes more prevalent, a detailed study of traffic analysis is necessary to understand the threats to privacy that patterns of communication pose, and to design effective countermeasures. Traffic analysis is also important for intrusion detection, to detect attacks and abnormalities that are embedded in encrypted traffic. The project will focus on two types of traffic analysis: flow linking, where packet timings are used to discover causal relationships between network streams, and semantic information extraction, where information about the flow contents is leaked through packet sizes and timings. In both cases, the goal of the project is to use information, detection, and queuing theory to discover the fundamental limits of traffic analysis and to design optimal defenses.
CT-ISG: Traffic Analysis: Attacks, Defenses, and Fundamental Limits