From ideality to practicability in statistical packet features masking

Traffic flow features like packet lengths, direction, gap times have been shown to carry significant information on conveyed the traffic flows they belong to, e.g. enabling application classification with high accuracy and even privacy breaking, even if encryption is used. Such a leakage of user related information can be stopped by modifying the traffic flow features, e.g. for packet lengths by padding, fragmenting or inserting dummy packets. We outline a general approach aiming at full masking of an application layer traffic flow; then, we address the trade-off between information leakage and overhead and we define a practical algorithm to achieve partial traffic masking. Experiments are carried out with traffic, captured on real networks. It turns out that overhead can be substantially reduced if requirements on information leakage are not too strict.