Large Scale Simulation of Tor: Stream Mix Networks Low latency - PowerPoint PPT Presentation

Large Scale Simulation of Tor: Stream Correlation Attacks Gavin O’ Gorman Anonymous Networks Large Scale Simulation of Tor: Stream Mix Networks Low latency Networks Network Correlation Attacks Simulation Results Attacks Gavin O’ Gorman Conclusion Dublin City University December 8, 2007

Large Scale Anonymous networks Simulation of Tor: Stream Correlation Attacks Gavin O’ Gorman Anonymous Networks Mix Networks Low latency Networks Network Simulation Results Attacks Conclusion

Large Scale Proxy Simulation of Tor: Stream Correlation Attacks Gavin O’ Gorman Anonymous Networks Mix Networks Low latency Networks Network Simulation Results Attacks Conclusion

Large Scale Simple Mix Simulation of Tor: Stream Correlation Attacks Gavin O’ Gorman Anonymous Networks Mix Networks Low latency Networks Network Simulation Results Attacks Conclusion

Large Scale Cascade Mix Simulation of Tor: Stream Correlation Attacks Gavin O’ Gorman Anonymous Networks Mix Networks Low latency Networks Network Simulation Results Attacks Conclusion

Large Scale Free Cascade Mix Simulation of Tor: Stream Correlation Attacks Gavin O’ Gorman Anonymous Networks Mix Networks Low latency Networks Network Simulation Results Attacks Conclusion

Large Scale Low latency network Simulation of Tor: Stream Correlation Attacks Gavin O’ Gorman Anonymous Networks Mix Networks Low latency Networks Network Simulation Results Attacks Conclusion

Large Scale Traffic Analysis Simulation of Tor: Stream Correlation Attacks Gavin O’ Gorman Anonymous Networks Mix Networks Low latency Networks Network Simulation Results Attacks Conclusion

Large Scale Currently deployed anonymous networks Simulation of Tor: Stream Correlation Attacks Gavin O’ Gorman Anonymous Networks Mix Networks Low latency Networks ◮ Over 1500 nodes Network Simulation ◮ Over 100 countries Results ◮ Hundreds of thousands on connections through the Attacks Conclusion network ◮ Theorized traffic analysis attacks

Large Scale Currently deployed anonymous networks Simulation of Tor: Stream Correlation Attacks Gavin O’ Gorman Anonymous Networks Mix Networks Low latency Networks ◮ Over 1500 nodes Network Simulation ◮ Over 100 countries Results ◮ Hundreds of thousands on connections through the Attacks Conclusion network ◮ Theorized traffic analysis attacks ◮ How anonymous is a user ?

Large Scale SSFNet Simulation of Tor: Stream Correlation Attacks Gavin O’ Gorman Anonymous ◮ Scalable Simulation Framework Network (SSFNet) Networks Mix Networks ◮ Simulate TCP/IP, Ethernet, Socket interfaces Low latency Networks Network ◮ Has HTTP/TCP generators. Simulation Results ◮ TCPDump compatible output Attacks Conclusion ◮ Simulated Tor circuits, routing, traffic fragmentation ◮ US ISP Topology ◮ 6,000 nodes ◮ Run the simulation for 1060 seconds to settle and then 60 for data

Large Scale Tor Simulation Process Simulation of Tor: Stream Correlation Attacks Gavin O’ Gorman Anonymous Networks Mix Networks Low latency Networks Network Simulation Results Attacks Conclusion

Large Scale Results Simulation of Tor: Stream Correlation Attacks Gavin O’ Gorman Anonymous Networks Mix Networks ◮ Probability of correctly identifying streams entering the Low latency Networks Network network with streams exiting the network Simulation ◮ Several attacks used Results Attacks ◮ Start and End timing Conclusion ◮ Packet counting ◮ Cross-Correlation - Pearson Function ◮ Run the attacks with increasing numbers of streams ◮ Don’t know the transit time, so have to test

Large Scale Start & End stream timing Simulation of Tor: Stream Correlation Attacks Gavin O’ Gorman Anonymous Networks Mix Networks Low latency Networks Network Simulation Results ◮ Compare the start and end times of streams Attacks ◮ 98% to 94% of streams filtered Conclusion

Large Scale Packet counting Simulation of Tor: Stream Correlation Attacks Gavin O’ Gorman Anonymous Networks Mix Networks Low latency Networks Network Simulation Results ◮ Count the number of cells in a stream Attacks ◮ 5% to 15% of streams are removed. Conclusion

Large Scale Cross-Correlation Simulation of Tor: Stream Correlation Attacks Gavin O’ Gorman Anonymous Networks Mix Networks Low latency Networks � i (( x i − µ )( x ′ i + d − µ ′ )) r ( d ) = Network �� Simulation �� i ( x i − µ ) 2 i + d − µ ′ ) 2 i ( x ′ Results Attacks Conclusion ◮ Set a windows size W and count the number of packets received ◮ x i is the i th packet count of stream x ◮ x ′ i is the i th packet count of stream x ′ ◮ µ is the average of packet counts in stream x ◮ d is the variable delay value

Large Scale Cross-Correlation Simulation of Tor: Stream Correlation Attacks Gavin O’ Gorman Fixed time window of 1s attack Anonymous 100 Networks Mix Networks Low latency Networks Network 80 Percentage of streams correctly correlated Simulation Results Attacks 60 Conclusion 40 20 0 0 5 10 15 20 25 Number of ASs

Large Scale Conclusion Simulation of Tor: Stream Correlation Attacks Gavin O’ Gorman Anonymous Networks Mix Networks Low latency Networks Network ◮ Initial results show promise Simulation ◮ Future work the simulation will allow us to: Results Attacks ◮ Introduce delay and measure QoS & Anonymity Conclusion ◮ Test active attacks ◮ Modify Tor protocol to account for specific attacks scenarios

Large Scale Thank you! Simulation of Tor: Stream Correlation Attacks Gavin O’ Gorman Anonymous Networks Mix Networks Low latency Networks Network ◮ Thanks for listening and thanks to Science Foundation Simulation Ireland Results Attacks Conclusion

Large Scale Any questions ? Simulation of Tor: Stream Correlation Attacks Gavin O’ Gorman Anonymous Networks Mix Networks Low latency Networks Network Simulation Results Attacks Conclusion