The Key to Deobfuscation is Pattern of Life, not Overcoming Encryption
Taylor Henderson, Eric Osterweil, Pavan Kumar Dinesh, and Robert Simon

TL;DR
This paper introduces a novel method for deobfuscating privacy-preserving online communications by analyzing patterns of life, successfully linking personas to IP addresses even when using PPTs like DoH, DoT, and VPNs.
Contribution
The work presents a new pattern of life-based deobfuscation technique effective against various PPTs, with a practical proof-of-concept tool for cybersecurity analysis.
Findings
Deobfuscation accuracy reaches up to 100% for DoH and DoT.
Monitoring at strategic internet vantage points enhances deobfuscation.
The methodology links online personas to IP addresses despite privacy measures.
Abstract
Preserving privacy is an undeniable benefit to users online. However, this benefit (unfortunately) also extends to those who conduct cyber attacks and other types of malfeasance. In this work, we consider the scenario in which Privacy Preserving Technologies (PPTs) have been used to obfuscate users who are communicating online with ill intentions. We present a novel methodology that is effective at deobfuscating such sources by synthesizing measurements from key locations along protocol transaction paths. Our approach links online personas with their origin IP addresses based on a Pattern of Life (PoL) analysis, and is successful even when different PPTs are used. We show that, when monitoring in the correct places on the Internet, DNS over HTTPS (DoH) and DNS over TLS (DoT) can be deobfuscated with up to 100% accuracy, when they are the only privacy-preserving technologies used. Our…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsPrivacy, Security, and Data Protection · Internet Traffic Analysis and Secure E-voting · User Authentication and Security Systems
