Camouflage of Network Traffic to Resist Attack (CONTRA)

By monitoring Internet traffic in the vicinity of a given host—which can be a single computer or a gateway device with multiple computers behind it—an attacker can observe communications originating from and destined to this host. Even if the message contents are encrypted, the IP addresses must remain visible for the packets to be properly routed throughout the open Internet. So the attacker can eventually discover the identity of all of the hosts with which this host communicates. In particular, if this host belongs to a collaborating set, such an attacker would be able to identify the remaining members of the set from simply observing the traffic in and out of this host. Moreover, by analyzing the traffic patterns the attacker may be able to glean useful information and also identify “high-value” hosts within the collaborative against which to mount a denial-of-service (DOS) attack.