Defeating traffic analysis via differential privacy: a case study on streaming traffic

Abstract

In this paper, we explore the adaption of techniques previously used in the domains of adversarial machine learning and differential privacy to mitigate the ML-powered analysis of streaming traffic. Our findings are twofold. First, constructing adversarial samples effectively confounds an adversary with a predetermined classifier but is less effective when the adversary can adapt to the defense by using alternative classifiers or training the classifier with adversarial samples. Second, differential-privacy guarantees are very effective against such statistical-inference-based traffic analysis, while remaining agnostic to the machine learning classifiers used by the adversary. We propose three mechanisms for enforcing differential privacy for encrypted streaming traffic and evaluate their security and utility. Our empirical implementation and evaluation suggest that the proposed statistical privacy approaches are promising solutions in the underlying scenarios

Appendix A: Appendix

Theorem 1

c $\mathbb {D}$, we have method A that is $\epsilon$-private, and method B that is $(d^*, \epsilon )$-private. We denote the maximum and minimum $d^*$ distance in $\mathbb {D}$ as $d_{max}$ and $d_{min}$. Then, we have:

(1) If B is ($d^*,\epsilon$)-private, then B is $(\epsilon d_{max})$-private.

(2) If A is $\epsilon$-private, then A is $(d^*,\frac{\epsilon }{d_{min}})$-private.

Proof According to the definitions, we have:

$$\begin{aligned}&A:\mathbb {P}(A(x)\in Z) \le exp(\epsilon _A) \times \mathbb {P}(A(x')\in Z) \end{aligned}$$

(A.1)

$$\begin{aligned}&B:\mathbb {P}(A(x)\in Z) \le exp(\epsilon _B \times d^*(x,x')) \times \mathbb {P}(A(x')\in Z)\nonumber \\ \end{aligned}$$

(A.2)

For B, we have:

$$\begin{aligned} \epsilon _B \times d_{min} \le \epsilon _B \times d^*(x,x') \le \epsilon _B \times d_{max} \end{aligned}$$

(A.3)

If B is ($d^*,\epsilon$)-private,

$$\begin{aligned} \frac{\mathbb {P}(A(x)\in Z)}{\mathbb {P}(A(x')\in Z)} = exp(\epsilon \times d^*(x,x')) \le exp(\epsilon \times d_{max})\nonumber \\ \end{aligned}$$

(A.4)

So B is at least $(\epsilon d_{max})$-private. Similarly, if A is $\epsilon$-private, let $\epsilon =\epsilon ' \times d^*(x,x')$, we have:

$$\begin{aligned} \epsilon ' = \frac{\epsilon }{d^*(x,x')} \le \frac{\epsilon }{d_{min}} \end{aligned}$$

(A.5)

So A is at least $(d^*,\frac{\epsilon }{d_{min}})$-private $\square$.