VPN Fingerprinting

VPN Fingerprinting: Network protocol detection inside virtual private network tunnels

Graafmans, Roy (TU Delft Electrical Engineering, Mathematics and Computer Science)

Doerr, Christian (mentor)
Zimmermann, P.R. (mentor)
Erkin, Z. (graduation committee)
Venkatesha Prasad, Ranga Rao (graduation committee)

Delft University of Technology

2021-12-15

Virtual private networks are often used to secure communication between two hosts and preserve privacy by tunneling all traffic over a single encrypted channel. Previous work has already shown that metadata of different secured channels can be used to fingerprint various kinds of information. In this work, we will dive into the encrypted tunnels as used by VPNs. We have collected automatically generated data of 9 network protocols sent over 8 different VPN solutions with 3 different rates for mixed traffic each. Due to the single combined traffic channel of the VPN, this work had to focus on packet-wise features instead of stream-wise ones, requiring the development of new features compared to related work. Both Random Forest and Markov Chains are trained to distinguish the network protocols by finding the patterns of the protocols in the developed features. We show that it is possible to fingerprint network protocols in all different scenarios based on the metadata available. Moreover, it was found that size features are more important than timing-related ones, especially when padding comes into place. Lastly, we show that obfuscations methods focussing on distorting size or timing patterns solely are not effective enough and future obfuscation methods should incorporate both features.

Virtual Private Network
VPN
Fingerprinting
Network traffic analysis
Machine Learning
Network protocols

http://resolver.tudelft.nl/uuid:d870398b-49d1-472e-b839-a2ce39409b1d

2022-12-15

Student theses

master thesis

© 2021 Roy Graafmans