Detecting Information Flows: Improving Chaff Tolerance by Joint Detection

The problem of detecting encrypted information flows using timing information is considered. An information flow consists of both information-carrying packets and irrelevant packets called chaff. A relay node can perturb the timing of information-carrying packets as well as adding or removing chaff packets. The goal is to detect whether there is an information flow through certain nodes of interest by analyzing the transmission times of these nodes. Under the assumption that the relay of information-carrying packets is subject to a bounded delay constraint, fundamental limits on detection are characterized as the minimum amount of chaff needed for an information flow to mimic independent traffic. A detector based on the optimal chaff-inserting algorithms is proposed. The detector guarantees detection in the presence of an amount of chaff proportional to the total traffic size; furthermore, the proportion increases to 100% exponentially fast as the number of hops on the flow path increases.