TWC: Small: Linking the Unlinkable: Design, Analysis, and Implementation of Network Flow Fingerprints for Fine-grained Traffic Analysis

网络流量分析员目前无法链接跨广域网络的网络流量以确定网络流量的来源，这对于了解攻击源至关重要。该项目正在开发一种用于链接网络流量的新技术，称为流量指纹识别，可以帮助网络防御者识别基于网络的攻击的来源，或帮助执法部门追踪犯罪活动的来源。这项工作还可能揭示在保护用户在线匿名的系统中必须解决的弱点。该项目调查用于流量分析的网络流量指纹。本课题有三个主要的研究方向：第一，将编码理论应用于网络流量指纹识别系统的设计中，为各种网络应用量身定制。其次，对流动指纹进行严格的理论分析，以确定其局限性和能力，并设计出特定威胁模型下的最佳指纹识别系统。分析的主旨是运用信息论和检测估计理论。第三，识别流指纹的真实应用场景，并在这种真实场景中实现所设计的流指纹系统，以评估其可用性和挑战。具体地说，该项目正在评估流量指纹在危害像Tor这样的大规模分布式匿名网络中的使用。

Network traffic analysts are currently unable to link network flows across wide area networks to determine the origin of a network traffic flow, which is critical in understanding sources of attacks. This project is developing a novel technique for linking network flows, called flow fingerprinting, that could help help network defenders identify the origin of a network-based attack or help law enforcement track the source of criminal activity. The work could also reveal weaknesses that must be addressed in systems that protect users online anonymity.This project investigates network flow fingerprinting for traffic analysis. The project has three main research thrusts: First, using coding theory in the design of network flow fingerprinting systems that are tailored for various networking applications. Second, performing rigorous theoretical analysis of flow fingerprints in order to identify their limitations and capabilities, as well as to devise optimum fingerprinting systems under specific threat models. The analysis thrust uses information theory and detection and estimation theory. Third, identifying real-world application scenarios for flow fingerprints, and implementing the devised flow fingerprinting systems in such real-world scenarios to assess their usability and challenges. Specifically, the project is evaluating the use of flow fingerprints in compromising large-scale, distributed anonymity networks like Tor.