DeTorrent: An Adversarial Padding-only Traffic Analysis Defense

TL;DR

DeTorrent is a neural network-based traffic padding defense that effectively reduces website fingerprinting and flow correlation attack success rates with moderate overhead, enhancing user privacy in anonymity networks like Tor.

Contribution

DeTorrent introduces a novel adversarial neural network approach for traffic padding that outperforms existing defenses against WF and FC attacks without significant latency.

Findings

Reduces attacker's accuracy by 61.5% in WF settings.

Cuts true positive rate for FC attacks to 0.12 at low false positive rate.

Maintains effectiveness when deployed on live Tor traffic.

Abstract

While anonymity networks like Tor aim to protect the privacy of their users, they are vulnerable to traffic analysis attacks such as Website Fingerprinting (WF) and Flow Correlation (FC). Recent implementations of WF and FC attacks, such as Tik-Tok and DeepCoFFEA, have shown that the attacks can be effectively carried out, threatening user privacy. Consequently, there is a need for effective traffic analysis defense. There are a variety of existing defenses, but most are either ineffective, incur high latency and bandwidth overhead, or require additional infrastructure. As a result, we aim to design a traffic analysis defense that is efficient and highly resistant to both WF and FC attacks. We propose DeTorrent, which uses competing neural networks to generate and evaluate traffic analysis defenses that insert 'dummy' traffic into real traffic flows. DeTorrent operates with moderate overhead and without delaying traffic. In a closed-world WF setting, it reduces an attacker's accuracy by 61.5%, a reduction 10.5% better than the next-best padding-only defense. Against the state-of-the-art FC attacker, DeTorrent reduces the true positive rate for a $10^{-5}$ false positive rate to about .12, which is less than half that of the next-best defense. We also demonstrate DeTorrent's practicality by deploying it alongside the Tor network and find that it maintains its performance when applied to live traffic.