No NAT'd User Left Behind: Fingerprinting Users behind NAT from NetFlow Records Alone
By Nino Vincenzo Verde, Giuseppe Ateniese, Emanuele Gabrielli, Luigi Vincenzo Mancini, Angelo Spognardi. 2014
51 citations recorded by the source corpus.
It is generally recognized that the network traffic generated by an individual acts as his biometric signature. Several tools exploit this fact to fingerprint and monitor users. Often, though, these tools access the entire traffic, including IP addresses and payloads. In general, this is not feasible on the grounds that both performance and privacy would be negatively affected. In reality, most ISPs convert user traffic into Net Flow records for a concise representation that does not include the payload. More importantly, a single IP address belonging to a large and distributed network is usually masked using Network Address Translation techniques, thus a few IP addresses may be associated to thousands of individuals (NAT'd IPs). We devised a new fingerprinting framework that overcomes these hurdles. Our system is able to analyze a huge amount of network traffic represented as Net Flows, with the intent to track people. It does so by accurately inferring when users are connected to the network and which IP addresses they are using, even though thousands of users are hidden behind NAT. Our prototype implementation was deployed and tested within an existing large metropolitan WiFi network serving about 200,000 users, with an average load of more than 1,000 users simultaneously connected behind 2 NAT'd IP addresses only. Our solution turned out to be very effective, with an accuracy greater than 90%. We also devised new tools and refined existing ones that may be applied to other contexts related to Net Flow analysis.
Subfields: Artificial Intelligence, Computer Networks and Communications
How researchers see this paper
The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.
In Artificial Intelligence
- Noah J. Apthorpe
- N. Feamster
- Arvind Narayanan
- Sunipa Dev
- Arjun Narayan
- Adina Williams
- Aleksandra Korolova
- Cynthia Dwork
In Computer Networks and Communications
Citations in the corpus
- Spying on the Smart Home: Privacy Attacks and Defenses on Encrypted IoT Traffic (2017, methodology): “Network traffic metadata has also been used to perform user and device fingerprinting by a variety of techniques, including correlating IP ID header fields [9], clock skews from the TCP timestamp option [24], and hidden Markov models trained on Netflow data [41].”