Techniques and countermeasures of website/wireless traffic analysis and fingerprinting

The behavior of a communication traffic may reveal some patterns (such as, packet size, packet direction, and inter-packet time, etc.) that can expose users’ identities and their private interactions. Such information may not be concealed even if encrypting protocols have been employed, which gives traffic analysis attacks an opportunity to infer the identities of the visited websites by Internet users, or the applications being running in wireless networks. In response, defense schemes and anonymity networks endeavor to disguise traffic features in order to preserve user privacy. This paper reviews existing traffic analysis techniques along with their countermeasures, and categorizes them into two main domains: websites and wireless. In addition, we propose a unified traffic analysis process model compound of a set of layers that demonstrate the stages of traffic analysis techniques. Then, factors that can impact the fingerprinting accuracy are elaborated to show how can the change of such factors affect the success results of fingerprinting. Finally, we present various potential challenges that need to be considered when implementing and deploying real-world traffic analysis systems. A recommendation of a future research direction regarding the enhancement of fingerprinting success rates and fair evaluation of them is also introduced.