TOPLDM: Towards dynamic low overhead traffic obfuscation based on packet length distribution modification

Abstract

The emergence of encrypted traffic fingerprinting has made it possible to monitor and analyze users’ online activities even under encrypted protocols like SSL/TLS, posing a serious threat to the personal privacy and data security. While researchers have proposed various traffic obfuscation methods to defend against encrypted traffic fingerprinting, there are still issues such as the high resource overhead, the weak robustness, the difficulty in dynamically adjusting obfuscation strategies and the inability to deploy in real network environments. To address these problems, this paper proposes an efficient and effective traffic obfuscation method based on packet length distribution modification. It designs a distribution-based packet length mapping method to dynamically adjust the mapping rules of packet lengths by selecting different target distributions. The packets are then modified by segmentation and stacking. By modifying the distribution of packet lengths, this method indirectly affects temporal features, effectively resisting encrypted traffic fingerprinting methods. Experimental results show that the approach outperforms existing traffic obfuscation methods in terms of obfuscation effectiveness, with 7 % success rate improved in real traffic obfuscation. Additionally, through comparative experiments with classic methods such as BuFLO, Cs-BuFLO, WTF-PAD, FRONT, Wfd-GAN, WGAN, and FGSM-AS, the advantages of this method in terms of time and bandwidth resource consumption are verified, and showing satisfactory robustness towards retrain.