No NAT'd user left behind: Fingerprinting users behind NAT from NetFlow records alone

Proceedings - International Conference on Distributed Computing Systems

Volumn , Issue , 2014, Pages 218-227

  Verde, Nino Vincenzo ^a   Ateniese, Giuseppe ^a   Gabrielli, Emanuele ^a   Mancini, Luigi Vincenzo ^a   Spognardi, Angelo ^b  

^a SAPIENZA UNIVERSITY OF ROME   (Italy)

^b CNR   (Italy)

Author keywords

[No Author keywords available]

Indexed keywords

WI-FI;

BIOMETRIC SIGNATURES; CONCISE REPRESENTATIONS; DISTRIBUTED NETWORKS; FLOW ANALYSIS; NETWORK ADDRESS TRANSLATIONS; NETWORK TRAFFIC; PROTOTYPE IMPLEMENTATIONS; WI FI NETWORKS;

INTERNET PROTOCOLS;

EID: 84907726670     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ICDCS.2014.30     Document Type: Conference Paper

References (41)

1. B. Claise. RFC 5101 (Proposed Standard), Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of IP Traffic Flow Information, 2008.
2. R. A. Baeza-Yates and B. Ribeiro-Neto. Modern Information Retrieval. Addison-Wesley Longman Publishing Co., Inc., Boston, MA, USA, 1999.
3. P. Barford and D. Plonka. Characteristics of network traffic flow anomalies. In Proceedings of the 1st ACM SIGCOMM Workshop on Internet Measurement, IMW '01, pages 69-73, New York, NY, USA, 2001. ACM.
4. K.-T. Chen and L.-W. Hong. User identification based on game-play activity patterns. Proceedings of the 6th ACM SIGCOMM workshop on Network and system support for games-NetGames '07, pages 7-12, 2007.
5. S. Chen, R. Wang, X. Wang, and K. Zhang. Side-Channel Leaks in Web Applications: A Reality Today, a Challenge Tomorrow. In Proceedings of the 2010 IEEE Symposium on Security and Privacy, pages 191-206. Ieee, 2010.
6. S. Dai, A. Tongaonkary, X. Wang, A. Nucci, and D. Song. Networkprofiler: Towards automatic fingerprinting of android apps. In Proceedings of the 32nd IEEE International Conference on Computer Communications, 2013.
7. L. Daigle. RFC 3912, WHOIS Protocol Specification, Internet Engineering Task Force. Technical report, 2004.
8. L. C. C. Desmond, C. C. Yuan, T. C. Pheng, and R. S. Lee. Identifying unique devices through wireless fingerprinting. In Proceedings of the first ACM conference on Wireless network security-WiSec '08, page 46, New York, New York, USA, 2008. ACM Press.
9. R. Durbin, S. Eddy, A. Krogh, and G. Mitchison. Biological sequence analysis: Probabilistic models of proteins and nucleic acids. Cambridge Univ. 1999.
10. K. P. Dyer, S. E. Coull, T. Ristenpart, and T. Shrimpton. Peek-a-Boo, I Still See You: Why Efficient Traffic Analysis Countermeasures Fail. In Proceedings of the 2012 IEEE Symposium on Security and Privacy, SP '12, pages 332-346, Washington, DC, USA, 2012. IEEE Computer Society.
11. T. Fawcett. Roc graphs: Notes and practical considerations for researchers. Technical report, HP Laboratories, 2004.
12. J. Franklin, D. McCoy, P. Tabriz, V. Neagoe, J. Van Randwyk, and D. Sicker. Passive data link layer 802.11 wireless device driver fingerprinting. Proceedings of the 15th conference on USENIX Security Symposium, 15:167-178, 2006.
13. D. Herrmann, C. Gerber, C. Banse, and H. Federrath. Analyzing Characteristic Host Access Patterns for Re-Identification of Web User Sessions. In Proceedings of the 15th Nordic conference on Information Security Technology for Applications, pages 136-154, 2012.
14. A. Inan, M. Kantarcioglu, and E. Bertino. Using anonymized data for classification. In Data Engineering, 2009. ICDE '09. IEEE 25th International Conference on, pages 429-440, March 2009.
15. D. Jurafsky and J. H. Martin. Speech and Language Processing (2nd Edition) (Prentice Hall Series in Artificial Intelligence). Prentice Hall, 2 edition, 2008.
16. T. Kanungo, D. M. Mount, N. S. Netanyahu, C. D. Piatko, R. Silverman, and A. Y. Wu. An efficient k-means clustering algorithm: Analysis and implementation. IEEE Transactions on Pattern Analysis and Machine Intelligence, 24(7):881-892, 2002.
17. T. Karagiannis, K. Papagiannaki, and M. Faloutsos. BLINC: Multilevel traffic classification in the dark. In Proceedings of the 2005 conference on Applications, technologies, architectures, and protocols for computer communications, pages 229-240, 2005.
18. T. Karagiannis, K. Papagiannaki, N. Taft, and M. Faloutsos. Profiling the end host. In Passive and Active Network Measurement, 8th Internatinoal Conference, PAM 2007, pages 186-196, 2007.
19. T. Kohno, A. Broido, and K. C. Claffy. Remote physical device fingerprinting. IEEE Trans. Dependable Secur. Comput., 2(2):93-108, 2005.
20. K.-F. Lee and H.-W. Hon. Large-vocabulary speaker-independent continuous speech recognition using hmm. In Acoustics, Speech, and Signal Processing, 1988. ICASSP-88., 1988 International Conference on, pages 123-126 vol.1, apr 1988.
21. M. Liberatore and B. Levine. Inferring the source of encrypted HTTP connections. In Proceedings of the 13th ACM conference on Computer and communications security, pages 255-263, 2006.
22. M. Ehrenfreund. NSA tracking phone locations on planetary scale. The Washington Post, 5 December 2013. Available: http://www.washingtonpost.com/world/national-security/nsa-tracking-phone-locations-on-planetary-scale/2013/12/05/dfe21740-5db2-11e3-bc56-c6ca94801fac story.html [Last accessed: 6 December 2013], 2013.
23. J. McHugh, R. McLeod, and V. Nagaonkar. Passive network forensics: Behavioural classification of network hosts based on connection patterns. SIGOPS Oper. Syst. Rev., 42(3):99-111, Apr. 2008.
24. N. Melnikov and J. Schonwalder. Cybermetrics: User identification through network flow analysis. In Proceedings of the 4th international conference on Autonomous infrastructure, management and security, pages 167-170, Zurich, Switzerland, 2010.
25. T. T. T. Nguyen, G. Armitage, P. Branch, and S. Zander. Timely and continuous machine-learning-based classification for interactive ip traffic. IEEE/ACM Trans. Netw., 20(6):1880-1894, Dec. 2012.
26. J. Pang, B. Greenstein, R. Gummadi, S. Seshan, and D. Wetherall. 802.11 User Fingerprinting. In Proceedings of the 13th annual ACM international conference on Mobile computing and networking, pages 99-110, New York, NY, USA, 2007. ACM.
27. D. Plonka. Flowscan: A network traffic flow reporting and visualization tool. In Proceedings of the 14th USENIX conference on System administration, LISA '00, pages 305-318, Berkeley, CA, USA, 2000. USENIX Association.
28. R. Brandom. The NSA tracks the location of hundreds of millions of phones. The Verge, 4 December 2013. Available: http://www.theverge.com/2013/12/4/5175778/the-nsa-tracks-the-location-of-hundreds-of-millions-of-phones [Last accessed: 6 December 2013], 2013.
29. L. R. Rabiner. A tutorial on hidden markov models and selected applications in speech recognition. Proceedings of the IEEE, 77(2):257-286, 1989.
30. D. Riboni, A. Villani, D. Vitali, C. Bettini, and L. Mancini. Obfuscation of sensitive data for incremental release of network flows. Networking, IEEE/ACM Transactions on, PP(99):1-1, 2014.
31. D. Rossi and S. Valenti. Fine-grained traffic classification with Netflow data. In Proceedings of the 6th International Wireless Communications and Mobile Computing Conference, pages 479-483. ACM, 2010.
32. T. Stöber, M. Frank, J. Schmitt, and I. Martinovic. Who do you sync you are?: Smartphone fingerprinting via application behaviour. In Proceedings of the sixth ACM conference on Security and privacy in wireless and mobile networks, pages 7-12, 2013.
33. Q. Sun, D. Simon, and Y. Wang. Statistical identification of encrypted web browsing traffic. In Proceedings of the 2002 IEEE Symposium on Security and Privacy, pages 19-30, 2002.
34. I. Trestian, S. Ranjan, A. Kuzmanovi, and A. Nucci. Unconstrained endpoint profiling (googling the internet). In Proceedings of the ACM SIGCOMM 2008 conference on Data communication-SIGCOMM '08, page 279, New York, New York, USA, 2008. ACM Press.
35. S. Wei, J. Mirkovic, and E. Kissel. Profiling and clustering internet hosts. In Proceedings of the 2006 International Conference on Data Mining, DMIN 2006, pages 269-275, Las Vegas, 2006.
36. C. V. Wright, L. Ballard, S. E. Coull, F. Monrose, and G. M. Masson. Spot Me if You Can: Uncovering Spoken Phrases in Encrypted VoIP Conversations. In Proceedings of the 2008 IEEE Symposium on Security and Privacy, pages 35-49, Washington, DC, USA, May 2008. IEEE Computer Society.
37. K. Xu, Z. Zhang, and S. Bhattacharyya. Profiling internet backbone traffic: Behavior models and applications. In Proceedings of the 2005 conference on Applications, technologies, architectures, and protocols for computer communications, pages 169-180, 2005.
38. K. Xu, Z.-J. Zhang, and S. Bhattacharyya. Internet Traffic Behavior Profiling for Network. IEEE/ACM Trans. Netw., 16(6):1241-1252, 2008.
39. J. Yan, N. Liu, G. Wang, W. Zhang, Y. Jiang, and Z. Chen. How much can behavioral targeting help online advertising? In Proceedings of the 18th International Conference on World Wide Web, WWW '09, pages 261-270, New York, NY, USA, 2009. ACM.
40. F. Zhang, W. He, X. Liu, and P. G. Bridges. Inferring users' online activities through traffic analysis. In Proceedings of the Fourth ACM Conference on Wireless Network Security, WiSec '11, pages 59-70, New York, NY, USA, 2011. ACM.
41. Z.-H. Zhou. Ensemble Methods : Foundations and Algorithms. CRC Press. 2012.