Analyzing Privacy in Enterprise Packet Trace Anonymization.

Abstract

Accurate network measurement through trace collection is critical for advancing network design and for maintaining secure, reliable networks. Unfortunately, the release of network traces to analysts is highly constrained by privacy concerns. Several anonymization schemes have been proposed to address this issue. Preservation of prefix relationships among anonymized addresses is an important aspect of trace utility, but also causes a number of vulnerabilities in trace anonymization. In this work we present a novel, systematic attack on prefix-preserving anonymization which can be efficiently executed by an adversary in possession of a modest amount of public information about the network. The attack is general (encompassing a range of fingerprinting attacks proposed by others) and flexible (it can be adapted to emerging variants of prefix-preserving anonymization). Perhaps most importantly, we develop analysis tools that allow data publishers to quantify the worst-case vulnerability of their trace given assumptions about the adversary’s external information. Using this analysis we quantify the trade-off between privacy and utility of alternatives to full prefix-preserving anonymization. 1