Anomaly Protection Using Batching Strategies

Traffic analysis is typically countered by the use of intermediary nodes, whose role is to perturb the traffic flow and thus confuse an external observer. Such intermediaries are called mixes. We address attacks that exploit the timing behaviour of TCP and other protocols and applications in low-latency anonymity networks. Intermediaries delay and reroute exchanged messages, reorder them, pad their size, or perform other operations such a mix network to handle mail traffic. Mixes have been used in many anonymous communication systems and are supposed to provide counter measures to defeat traffic analysis attacks. There are many attacks that occur in the networks such as Sinkhole attacks, Wormhole attacks, and flow correlation attacks and so on. We focus on a particular class of traffic analysis attacks, known as flow correlation attacks, by which an adversary attempts to analyse the network traffic and correlate the traffic of a flow over an input link with that over an output link. Flow-correlation attacks attempt to reduce the anonymity degree by estimating the path of flows through the mix network. Two classes of correlation methods are considered, namely time-domain methods and frequency-domain methods. In the time domain, statistical information about rate distributions is collected and used to identify the traffic dependency. In the frequency domain, it identifies traffic similarities by comparing the Fourier spectra of timing data. The empirical results provided in this paper give an indication to designers of Mix networks about appropriate configurations and mechanisms to be used to counter flow-correlation attacks. Index Terms Mix, anonymity, flow-correlation attack, intermediaries node, security.