[Paper Review] SiamHAN: IPv6 Address Correlation Attacks on TLS Encrypted Traffic via Siamese Heterogeneous Graph Attention Network

Tianyu Cui, Gaopeng Gou+4 more|arXiv (Cornell University)|Apr 20, 2022

Internet Traffic Analysis and Secure E-voting28 references4 citations

TL;DR

This paper proposes SiamHAN, a Siamese Heterogeneous Graph Attention Network that correlates IPv6 addresses to users via TLS-encrypted traffic by modeling multi-level semantic features in knowledge graphs. It achieves 99% accuracy in long-term user tracking and 88% in user discovery—significantly outperforming state-of-the-art methods like Deepcorr, which achieve only 85% and 60% respectively.

ABSTRACT

Unlike IPv4 addresses, which are typically masked by a NAT, IPv6 addresses could easily be correlated with user activity, endangering their privacy. Mitigations to address this privacy concern have been deployed, making existing approaches for address-to-user correlation unreliable. This work demonstrates that an adversary could still correlate IPv6 addresses with users accurately, even with these protection mechanisms. To do this, we propose an IPv6 address correlation model - SiamHAN. The model uses a Siamese Heterogeneous Graph Attention Network to measure whether two IPv6 client addresses belong to the same user even if the user's traffic is protected by TLS encryption. Using a large real-world dataset, we show that, for the tasks of tracking target users and discovering unique users, the state-of-the-art techniques could achieve only 85% and 60% accuracy, respectively. However, SiamHAN exhibits 99% and 88% accuracy.

Motivation & Objective

• Address the growing privacy threat posed by IPv6 address correlation in TLS-encrypted traffic, especially as NAT is rare and addresses are often static or predictable.
• Overcome limitations of prior methods that rely on address structure or traffic pattern analysis, which suffer from false positives and limited scalability.
• Develop a scalable, accurate method to correlate arbitrary IPv6 addresses to the same user even when protected by TLS encryption and address randomization.
• Demonstrate that multi-level attention and metric learning on heterogeneous knowledge graphs can significantly improve user correlation accuracy over existing approaches.

Proposed method

• Construct a heterogeneous knowledge graph for each IPv6 client address using multi-type semantic meta-information from TLS handshake and traffic patterns.
• Employ a Siamese network architecture to compare pairs of knowledge graphs, enabling end-to-end learning of address-to-user correlation.
• Integrate a heterogeneous graph attention network (HGAT) to capture complex, multi-level relationships across different node and edge types in the knowledge graphs.
• Apply metric learning via a contrastive loss function to learn a robust distance metric that measures similarity between two client graphs.
• Use multi-head attention mechanisms to dynamically weigh the importance of different features and relationships in the graphs.
• Train the model on a 5-month real-world IPv6 traffic dataset collected at a vantage point, using both positive and negative pairs for contrastive learning.

Experimental results

Research questions

• RQ1 Can a machine learning model effectively correlate IPv6 addresses to the same user based on TLS-encrypted traffic, even when address randomization and encryption are in place?
• RQ2 How does the proposed SiamHAN model compare in performance to state-of-the-art correlation techniques like Deepcorr in long-term user tracking and user discovery tasks?
• RQ3 To what extent do multi-level attention and metric learning improve the accuracy of IPv6 address correlation compared to simpler classification or embedding-based approaches?
• RQ4 What are the most effective countermeasures against such correlation attacks, and how do traffic obfuscation and attack surface reduction impact model performance?

Key findings

• SiamHAN achieves 99% accuracy in tracking target users over a 5-month period, significantly outperforming Deepcorr’s 85% accuracy.
• For user discovery, SiamHAN reaches 88% accuracy, compared to Deepcorr’s 60%, demonstrating superior scalability and robustness.
• The model maintains high performance even with only one month of background knowledge, achieving 90% accuracy in pairwise address correlation.
• Replacing the distance metric with a binary classifier (SiamHAN-Classifier) results in a significant drop in performance, confirming the superiority of metric learning.
• Combining multiple traffic obfuscation techniques (e.g., random forged addresses and background traffic) reduces SiamHAN’s accuracy to 70.5% in address correlation, indicating that defense is feasible when multiple layers are applied.
• The time complexity of SiamHAN is O(cN) for tracking and O(kN) for discovery, making it efficient for large-scale deployment in real-world monitoring scenarios.