Watch out for the mole: Can the obfuscation defences put in place by DAITA be circumvented for video fin gerprinting?

Abstract

In an ever increasingly digital world where user data has become a commodity to be analysed and sold, digital privacy is growing evermore important. Despite the widespread adoption of privacy solutions such as HTTPS and VPNs, information about network traffic is still leaked despite encryption. One such case being the adaptive bitrate protocols used for video streaming, such as MPEG-DASH. In the last years the severity of this vulnerability has become apparent. In a recent study by Björklund and Duvignau, it has proved feasible to use this leak to build an attack on a large scale, covering hundreds of thousands of videos across multiple video streaming providers, capable of identifying streamed video traffic with high accuracy. While there are certain tools that are used to mitigate these types of traffic analysis attacks, one such tool being Mullvad VPN’s DAITA, it has not previously been known to what extent it protects against analysis of video traffic. This thesis investigates to what extent DAITA protects against the attack, showing that during testing a protection of 78% was observed. This work has also looked at the underlying traffic patterns of video streaming using DAITA, and found that the degree of protection is likely dependent on DAITA’s internal system parameters and on what content is being streamed. Alternative identification logic is tested in an attempt to circumvent the added noise introduced by DAITA. Additionally the feasibility of reducing the size of the required dataset was investigated, which if possible would show that an attack utilizing this vulnerability would be cheaper to deploy on a large scale, making further defensive advancements an important matter.