Can t You Hear Me Knocking: Security and Privacy Threats from ML Application to Contextual Information

Transcription

1 Can t You Hear Me Knocking: Security and Privacy Threats from ML Application to Contextual Information Contextual Security Workshop Contextual Security: Quo Vadis? Aalto University, Helsinki - December 2, 2015 Mauro Conti SPRITZ Security and Privacy Research Group University of Padua, Italy conti@math.unipd.it

2 Presentation overview 1. Traditional vs. Contextual Security

3 Traditional Security Crypto, Applied-Crypto, Protocols,... There are pitfalls and limitations

4 SSL (in)-security Motivation SSL is widely used but not fully understood by developers (particularly for mobile apps...) problem raised by two CCS 2012 papers expired and self sign. certif, SSL stripping... Some libraries are error-prone (if not worst) e.g. curl default should be 2 (true -> 1...)

5 MITHYS (STM-ESORICS 13) MITHYS: architecture

6 Contextual Security

7 Contextual Security By applying machine learning techniques to contextual information, we can design intuitive and usable security and privacy solutions for ordinary users without sacrificing the level of protection.

8 Contextual Security By applying machine learning techniques to contextual information, we can design intuitive and usable security and privacy solutions for ordinary users without sacrificing the level of protection.

9 Contextual Security By applying machine learning techniques to contextual information, we can design intuitive and usable security and privacy solutions for ordinary users without sacrificing the level of protection. What if

10 Contextual Security By applying machine learning techniques to contextual information, we can design intuitive and usable security and privacy solutions for ordinary users without sacrificing the level of protection. What if the adversary leverages the same techniques?

11 Contextual Security By applying machine learning techniques to contextual information, we can design intuitive and usable security and privacy solutions for ordinary users without sacrificing the level of protection. What if the adversary leverages the same techniques? How can we protect contextual information?

12 Presentation overview 1. Traditional vs. Contextual Security 2. Can t you hear me knocking (CODASPY 14, IEEE TIFS 15) M. Conti, L. Mancini, R. Spolaor, and N. Verde 3. AppScanner (IEEE EuroS&P 16) V. Taylor, R. Spolaor, M. Conti and I. Martinovich 4. Preserving Smartphone Users' Anonymity in Cloudy Days (MobiPST-ICCCN 13, IEEE TSC 14) C. Ardagna, M. Conti, M. Leone, J. Stefa

13 Can t you hear me knocking (CODASPY 14, TIFS 15) Motivation SSH Encryption is not enough! [Song et al. '11] VoIP [Wright et al. '08]

14 Can t you hear me knocking (CODASPY 14, TIFS 15) Attacker's observations Coarse features: Packet lengths Packet directions Packet timings Enable Traffic Analysis Attacks. Services

15 Attack scenario *

16 Attack scenario *

17 Attack scenario *

18 Other attack scenarios To identify communicating parties from sending/receiving pattern Behavioural profiling to improve fingerpritings for marketing reasons...

19 Can t you hear me knocking (CODASPY 14, TIFS 15) The goal Can an attacker recognize actions that a user performs on some android app by analyzing the encrypted network traffic? *

20 Can t you hear me knocking (CODASPY 14, TIFS 15) Key Concepts *

21 Can t you hear me knocking (CODASPY 14, TIFS 15) Dataset collection *

22 Can t you hear me knocking (CODASPY 14, TIFS 15) Network Traffic Flows Representation *

23 Can t you hear me knocking (CODASPY 14, TIFS 15) The framework Labeled Dataset Phase 1. Training Phase 2. Testing Network Traffic Pre-processor User Action Classifier Random Forest Predictions - Tweet sent - answered - tweeter contact opened... *

24 Can t you hear me knocking (CODASPY 14, TIFS 15) Training phase 1. Unsupervised learning Clusters of similar flows Dynamic Time Warping (DTW) [Müller 2007] as metric The number of clusters is a parameter to tune 2. Training set building User actions Classes Cluster labels Features IDs user actions cluster 0 cluster 1... cluster k. cluster N-1 cluster N 001 send mail send mail send reply Supervised learning Random Forest classifier

25 Can t you hear me knocking (CODASPY 14, TIFS 15) Evaluation phase 1. User actions produce unseen flows 2. Assign each unseen flow to a cluster clusters used in training phase and DTW as metric 3. Test set building (similarly to training set) User actions unknown classes Cluster labels Features 4. User action recognition

26 Can t you hear me knocking (CODASPY 14, TIFS 15) Accuracy vs. number of clusters *

27 Can t you hear me knocking (CODASPY 14, TIFS 15) Accuracy per user action *

28 Can t you hear me knocking (CODASPY 14, TIFS 15) Conclusions Encryption does not hide communication patterns We shown that user actions performed on Android apps can be detected by analyzing the encrypted network traffic Attackers can leverage our framework to undermine user privacy: Learn user habits Gain commercial or intelligence advantage against some competitor Attribution of social network pseudonyms Countermeasures to this type of attacks are needed...

29 AppScanner (IEEE EuroS&P 16)

30 AppScanner (IEEE EuroS&P 16) Motivation Given a target app X Identify the presence of X in a mobile device Using network traffic analysis

31 AppScanner (IEEE EuroS&P 16) Motivation Given a target app X Identify the presence of X in a mobile device Using network traffic analysis It isn t so easy!

32 AppScanner (IEEE EuroS&P 16) Motivation Given a target app X Identify the presence of X in a mobile device Using network traffic analysis It isn t so easy! Encryption Payload inspection is not feasible

33 AppScanner (IEEE EuroS&P 16) Motivation Given a target app X Identify the presence of X in a mobile device Using network traffic analysis It isn t so easy! Encryption Payload inspection is not feasible Owner of Destination IP App Content Delivery Network (CDN) Proxy

34 AppScanner (IEEE EuroS&P 16) Attacker's observations (similarly to the previous work) Packet length Packet directions Packet timings Enable Traffic Analysis Attacks Proxy

35 AppScanner (IEEE EuroS&P 16) Traditional Client-Server Architecture Content Delivery Network CDN

36 AppScanner (IEEE EuroS&P 16) Three different approaches proposed:

37 AppScanner (IEEE EuroS&P 16) Three different approaches proposed: 1. Per flow length classification A classifier for each length No out-of-order packets resiliency, but fast

38 AppScanner (IEEE EuroS&P 16) Three different approaches proposed: 1. Per flow length classification A classifier for each length No out-of-order packets resiliency, but fast 2. Large Multi-class classification Uses statistics on network flows It works on a set of apps High Accuracy and out-of-order packets resiliency, but slow

39 AppScanner (IEEE EuroS&P 16) Three different approaches proposed: 1. Per flow length classification A classifier for each length No out-of-order packets resiliency, but fast 2. Large Multi-class classification Uses statistics on network flows It works on a set of apps High Accuracy and out-of-order packets resiliency, but slow 3. Per App classification Uses statistics on network flows It focuses on a specific app Binary classification (app is present of not)

40 AppScanner (IEEE EuroS&P 16) Building the dataset TCP Packets captured Datesets

41 AppScanner (IEEE EuroS&P 16) Building the dataset TCP Packets captured

42 AppScanner (IEEE EuroS&P 16) Building the dataset TCP Packets captured Per Flow approach (1)

43 AppScanner (IEEE EuroS&P 16) Building the dataset TCP Packets captured Per Flow approach (1)

44 AppScanner (IEEE EuroS&P 16) Building the dataset TCP Packets captured Per Flow approach (1)

45 AppScanner (IEEE EuroS&P 16) Building the dataset TCP Packets captured Per Flow approach (1) Statistical approaches (2, 3)

46 AppScanner (IEEE EuroS&P 16) Improving the accuracy of AppScanner Classification performed on each network traffic flow We aim to identify an app many flows available Flow Classifier prediction (App, Probability of prediction) Applying a probability threshold (pt) Filter out flows with uncertain predictions Increase classification accuracy tuning pt

47 Competitors AppScanner (IEEE EuroS&P 16) (1) Performance and Comparison (2) (3)

48 Preserving Smartphone Users' Anonymity in Cloudy Days (MobiPST 13, IEEE TSC 14)

49 Preserving Smartphone Users' Anonymity in Cloudy Days (MobiPST 13, IEEE TSC 14)

50 Preserving Smartphone Users' Anonymity in Cloudy Days (MobiPST 13, IEEE TSC 14)

51 Preserving Smartphone Users' Anonymity in Cloudy Days (MobiPST 13, IEEE TSC 14) Proposed Protocol (sketch)

52 Preserving Smartphone Users' Anonymity in Cloudy Days (MobiPST 13, IEEE TSC 14) Communication steps Sender (1) Receiver (3) Clone communication (2)

53 Thank you for you attention! Questions?