Abstract-The problem of detecting encrypted information flows using timing information is considered. An information flow consists of both information-carrying packets and irrelevant packets called chaff. A relay node can perturb the timing of information-carrying packets as well as adding or removing chaff packets. The goal is to detect whether there is an information flow through certain nodes of interest by analyzing the transmission times of these nodes. Under the assumption that the relay of information-carrying packets is subject to a bounded delay constraint, fundamental limits on detection are characterized as the minimum amount of chaff needed for an information flow to mimic independent traffic. A detector based on the optimal chaff-inserting algorithms is proposed. The detector guarantees detection in the presence of an amount of chaff proportional to the total traffic size; furthermore, the proportion increases to 100% exponentially fast as the number of hops on the flow path increases.
We significantly advanced the state of the art by a threshold detector developed in REF based on the estimated fraction of chaff noise, which can achieve consistent detection under a number of chaff packets that grows proportionally to the traffic size.
Detecting Information Flows: Improving Chaff Tolerance by Joint Detection
2007 41st Annual Conference on Information Sciences and Systems
2007 41st Annual Conference on Information Sciences and Systems
Computer Science