You cannot hide for long: de-anonymization of real-world dynamic behaviour

Abstract

Disclosure attacks against anonymization systems have traditionally assumed that users exhibit stable patterns of communications in the long term. We use datasets of real traffic to show that this assumption does not hold: usage patterns email, mailing lists, and location-based services are dynamic in nature. We introduce the sequential statistical disclosure technique, which explicitly takes into account the evolution of user behavior over time and outperforms traditional profiling techniques, both at detection and quantification of rates of actions. Our results demonstrate that despite the changing patterns of use: low sending rates to specific receivers are still detectable, surprisingly short periods of observation are sufficient to make inferences about users' behaviour, and the characteristics of real behaviour allows for inferences even in secure system configurations.