TWC: Small: Linking the Unlinkable: Design, Analysis, and Implementation of Network Flow Fingerprints for Fine-grained Traffic Analysis

网络流量分析人员目前无法通过广域网连接网络流量来确定网络流量的来源，这对于理解攻击来源至关重要。这个项目正在开发一种连接网络流的新技术，称为流量指纹，它可以帮助网络防御者识别基于网络的攻击的来源，或者帮助执法部门追踪犯罪活动的来源。这项工作还可能揭示保护用户在线匿名的系统中必须解决的弱点。本项目研究用于流量分析的网络流量指纹。该项目有三个主要的研究重点：第一，使用编码理论设计网络流指纹系统，为各种网络应用量身定制。其次，对流动指纹进行严格的理论分析，以确定其局限性和能力，并在特定的威胁模型下设计最佳的指纹识别系统。分析主要运用信息论和检测估计理论。第三，确定流动指纹的实际应用场景，并在实际场景中实施设计的流动指纹系统，评估其可用性和挑战。具体来说，该项目正在评估流指纹在破坏大规模分布式匿名网络（如Tor）中的使用。

Network traffic analysts are currently unable to link network flows across wide area networks to determine the origin of a network traffic flow, which is critical in understanding sources of attacks. This project is developing a novel technique for linking network flows, called flow fingerprinting, that could help help network defenders identify the origin of a network-based attack or help law enforcement track the source of criminal activity. The work could also reveal weaknesses that must be addressed in systems that protect users online anonymity.This project investigates network flow fingerprinting for traffic analysis. The project has three main research thrusts: First, using coding theory in the design of network flow fingerprinting systems that are tailored for various networking applications. Second, performing rigorous theoretical analysis of flow fingerprints in order to identify their limitations and capabilities, as well as to devise optimum fingerprinting systems under specific threat models. The analysis thrust uses information theory and detection and estimation theory. Third, identifying real-world application scenarios for flow fingerprints, and implementing the devised flow fingerprinting systems in such real-world scenarios to assess their usability and challenges. Specifically, the project is evaluating the use of flow fingerprints in compromising large-scale, distributed anonymity networks like Tor.