Defending against Traffic Analysis Attacks with Flexible In-Network Obfuscation
summary
Securitas is an in-network obfuscation framework that uses packet fragmentation and small-TTL packet insertion (triggering ICMP replies) and trains an LSTM agent with policy-gradient feedback from a proxy DNN. It runs on Tofino, AMD/Xilinx FPGA, eBPF and BMv2, processes up to 95 Gbps on Tofino and 75 Gbps on FPGA, cuts attacker accuracy by ~95.9% while using ~42.7× less bandwidth than prior defenses, adds ~0.15 s to page loads and introduces 0.2–0.3 s extra latency for some IoT traffic.
AI-written summary · about
chapters (11)
- 0:00Traffic analysis attacks intro
- 2:05Current defense limits
- 3:28SecureDNS framework
- 4:34New system challenges
- 6:21Key contributions
- 7:46Packet fragmentation obfuscation
- 9:11TTL insertion obfuscation
- 10:59Balancing obfuscation strategies
- 13:08P4 implementation
- 14:55Experimental results
- 17:26Conclusion
related talks
18mMinos : A Lightweight and Dynamic Defense against Traffic Analysis in...
24mNetHide: Secure and Practical Network Topology Obfuscation
30mApplication network security and observability in an encrypted future
35mThe Best Defense is a Great Offense: Leveraging Automated...
40mSecuring Connections: Defending Telco Workloads in the Cloud Era
28mSecuring the IoT: High-speed cryptography and Edward Snowden
40mEnemy Inside the Gates: Securing the New Battleground
30mLessons From Defending The Indefensible