liberate, (n): A library for exposing (tra ffi c-classification) - - PowerPoint PPT Presentation

▶
liberate n
SMART_READER_LITE
LIVE PREVIEW

liberate, (n): A library for exposing (tra ffi c-classification) - - PowerPoint PPT Presentation

Dec 30, 2022 369 likes •1.54k views

liberate, (n): A library for exposing (tra ffi c-classification) rules and avoiding them e ffi ciently Fangfan Li , Abbas Razaghpanah, Arash Molavi Kakhki, Arian Akhavan Niaki, David Cho ff nes, Phillipa Gill, Alan Mislove 1 Traffic management 2

slide-1
SLIDE 1

liberate, (n):

A library for exposing (traffic-classification) rules and avoiding them efficiently

1

Fangfan Li, Abbas Razaghpanah, Arash Molavi Kakhki, Arian Akhavan Niaki, David Choffnes, Phillipa Gill, Alan Mislove

slide-2
SLIDE 2

Traffic management

2

slide-3
SLIDE 3

Traffic management

2

Throttling Internet Service Provider

slide-4
SLIDE 4

Traffic management

2

Blocking Throttling Internet Service Provider

slide-5
SLIDE 5

Traffic management

2

Blocking Throttling Internet Service Provider

slide-6
SLIDE 6

Traffic management

2

Blocking Zero rating Throttling Internet Service Provider

slide-7
SLIDE 7

Traffic management

2

Blocking Zero rating Throttling Internet Service Provider

slide-8
SLIDE 8

Example policy

3

slide-9
SLIDE 9

Example policy

3

slide-10
SLIDE 10

Example policy

3

slide-11
SLIDE 11

Example policy

3

slide-12
SLIDE 12

Lack of user control

4

Throttling

slide-13
SLIDE 13

Lack of user control

4

Throttling

  • Policies are implemented by DPI (Deep Packet Inspection) devices [IMC 16]
slide-14
SLIDE 14

Lack of user control

4

Throttling

  • Policies are implemented by DPI (Deep Packet Inspection) devices [IMC 16]

Youtube

slide-15
SLIDE 15

Lack of user control

4

Throttling

  • Policies are implemented by DPI (Deep Packet Inspection) devices [IMC 16]
  • Differentiation policy can be harmful or unwanted to users/content providers

Youtube

slide-16
SLIDE 16

Lack of user control

4

Throttling

  • Policies are implemented by DPI (Deep Packet Inspection) devices [IMC 16]
  • Differentiation policy can be harmful or unwanted to users/content providers
  • Users/content providers have no control over these policies

Youtube

slide-17
SLIDE 17

Previous work

slide-18
SLIDE 18

Previous work

  • Approaches:
  • VPNs and proxies
  • Covert channels
  • Obfuscating traffic
  • Domain fronting
slide-19
SLIDE 19

Previous work

  • Approaches:
  • VPNs and proxies
  • Covert channels
  • Obfuscating traffic
  • Domain fronting
  • Limitations:
slide-20
SLIDE 20

Previous work

  • Approaches:
  • VPNs and proxies
  • Covert channels
  • Obfuscating traffic
  • Domain fronting
  • Limitations:
  • Brittle
slide-21
SLIDE 21

Previous work

  • Approaches:
  • VPNs and proxies
  • Covert channels
  • Obfuscating traffic
  • Domain fronting
  • Limitations:
  • Brittle
  • Development effort
slide-22
SLIDE 22

Previous work

  • Approaches:
  • VPNs and proxies
  • Covert channels
  • Obfuscating traffic
  • Domain fronting
  • Limitations:
  • Brittle
  • Development effort
  • Performance
slide-23
SLIDE 23

Previous work

  • Approaches:
  • VPNs and proxies
  • Covert channels
  • Obfuscating traffic
  • Domain fronting
  • Limitations:
  • Brittle
  • Development effort
  • Performance
  • Manual inspection
slide-24
SLIDE 24

Goals of liberate

6

Evade throttling

liberate

slide-25
SLIDE 25

Goals of liberate

6

  • A technical solution for detecting and evading unwanted policies

Evade throttling

liberate

slide-26
SLIDE 26

Goals of liberate

6

  • A technical solution for detecting and evading unwanted policies
  • Enables unmodified applications to evade

Evade throttling

liberate

slide-27
SLIDE 27

Goals of liberate

6

  • A technical solution for detecting and evading unwanted policies
  • Enables unmodified applications to evade
  • Automatically

Evade throttling

liberate

slide-28
SLIDE 28

Goals of liberate

6

  • A technical solution for detecting and evading unwanted policies
  • Enables unmodified applications to evade
  • Automatically
  • Adaptively

Evade throttling

liberate

slide-29
SLIDE 29

Goals of liberate

6

  • A technical solution for detecting and evading unwanted policies
  • Enables unmodified applications to evade
  • Automatically
  • Adaptively
  • Unilaterally

Evade throttling

liberate

slide-30
SLIDE 30

Goals of liberate

6

  • A technical solution for detecting and evading unwanted policies
  • Enables unmodified applications to evade
  • Automatically
  • Adaptively
  • Unilaterally
  • With low overhead

Evade throttling

liberate

slide-31
SLIDE 31

Goals of liberate

6

  • A technical solution for detecting and evading unwanted policies
  • Enables unmodified applications to evade
  • Automatically
  • Adaptively
  • Unilaterally
  • With low overhead

Evade throttling

Unknown

liberate

slide-32
SLIDE 32

Outline

  • Design and implementation
  • Traffic-classification rules detection
  • Evasion techniques
  • Implementation
  • Evaluation
  • Effectiveness across multiple networks

7

slide-33
SLIDE 33

Overview of liberate

8

slide-34
SLIDE 34

Overview of liberate

8

slide-35
SLIDE 35

Overview of liberate

8

slide-36
SLIDE 36

Overview of liberate

8

slide-37
SLIDE 37

Overview of liberate

8

slide-38
SLIDE 38

Overview of liberate

8

slide-39
SLIDE 39

Outline

  • Design and implementation
  • Traffic-classification rules detection
  • Evasion techniques
  • Implementation
  • Evaluation
  • Effectiveness across multiple networks

9

slide-40
SLIDE 40

Design

Traffic-classification rules detection

10

slide-41
SLIDE 41

Design

Traffic-classification rules detection

10

VPN Channel

VPN server Client

Recorded traffic

  • How to detect differentiation?
  • Record and Replay [IMC 15]
slide-42
SLIDE 42

Design

Traffic-classification rules detection

10 Replay Client

Replay server

VPN Channel VPN server Client Recorded traffic

Recorded traffic Recorded traffic

  • How to detect differentiation?
  • Record and Replay [IMC 15]
slide-43
SLIDE 43

Design

Traffic-classification rules detection

10 Replay Client

Replay server

VPN Channel VPN server Client Recorded traffic

Recorded traffic Recorded traffic

  • How to detect differentiation?
  • Record and Replay [IMC 15]
slide-44
SLIDE 44

Design

Traffic-classification rules detection

10 Replay Client

Replay server

VPN Channel VPN server Client Recorded traffic

Recorded traffic Recorded traffic

  • How to detect differentiation?
  • Record and Replay [IMC 15]
  • How to evade differentiation efficiently?
slide-45
SLIDE 45

Design

Traffic-classification rules detection

10 Replay Client

Replay server

VPN Channel VPN server Client Recorded traffic

Recorded traffic Recorded traffic

  • How to detect differentiation?
  • Record and Replay [IMC 15]
  • How to evade differentiation efficiently?
  • Understand classification rules [IMC 16]
slide-46
SLIDE 46

Design

Traffic-classification rules detection

10 Replay Client

Replay server

VPN Channel VPN server Client Recorded traffic

Recorded traffic Recorded traffic

  • How to detect differentiation?
  • Record and Replay [IMC 15]
  • How to evade differentiation efficiently?
  • Understand classification rules [IMC 16]

GET /url Host: www.googlevideo.com …

slide-47
SLIDE 47

Design

Traffic-classification rules detection

10 Replay Client

Replay server

VPN Channel VPN server Client Recorded traffic

Recorded traffic Recorded traffic

  • How to detect differentiation?
  • Record and Replay [IMC 15]
  • How to evade differentiation efficiently?
  • Understand classification rules [IMC 16]

GET /url Host: www.googlevideo.com …

Header Example matching content URI site.js{…}-nbcsports-com Host Host: www.spotify.com User-Agent User-Agent: Pandora 5.0{…} Content-Type Content-Type: video SNI googlevideo.com

slide-48
SLIDE 48

Outline

  • Design and implementation
  • Traffic-classification rules detection
  • Evasion techniques
  • Implementation
  • Evaluation
  • Effectiveness across multiple networks

11

slide-49
SLIDE 49

Design

Example classification

12

How does classifier classify application B?

slide-50
SLIDE 50

Design

Example classification

12

How does classifier classify application B?

slide-51
SLIDE 51

Design

Example classification

12

How does classifier classify application B?

slide-52
SLIDE 52

Design

Example classification

12

How does classifier classify application B?

slide-53
SLIDE 53

Design

Example classification

12

How does classifier classify application B?

slide-54
SLIDE 54

Design

Example classification

12

How does classifier classify application B?

slide-55
SLIDE 55

Design

Example classification

12

How does classifier classify application B?

Matching contents : ‘GET /B’

slide-56
SLIDE 56

Design

Evasion techniques

13

* Christian Kreibich et al. 2001. Network intrusion detection: Evasion, traffic normalization, and end-to-end protocol semantics.

Using a small TTL value

slide-57
SLIDE 57

Design

Evasion techniques

  • Observation:
  • ‘Match and forget’ behavior

13

* Christian Kreibich et al. 2001. Network intrusion detection: Evasion, traffic normalization, and end-to-end protocol semantics.

Using a small TTL value

slide-58
SLIDE 58

Design

Evasion techniques

  • Observation:
  • ‘Match and forget’ behavior
  • Incomplete views of the connection

13

* Christian Kreibich et al. 2001. Network intrusion detection: Evasion, traffic normalization, and end-to-end protocol semantics.

Using a small TTL value

slide-59
SLIDE 59

Design

Evasion techniques

  • Observation:
  • ‘Match and forget’ behavior
  • Incomplete views of the connection
  • Inert packet insertion* : Traffic processed only by a classifier but not endpoint

13

* Christian Kreibich et al. 2001. Network intrusion detection: Evasion, traffic normalization, and end-to-end protocol semantics.

Using a small TTL value

slide-60
SLIDE 60

Design

Evasion techniques

  • Observation:
  • ‘Match and forget’ behavior
  • Incomplete views of the connection
  • Inert packet insertion* : Traffic processed only by a classifier but not endpoint

13

* Christian Kreibich et al. 2001. Network intrusion detection: Evasion, traffic normalization, and end-to-end protocol semantics.

Using a small TTL value

slide-61
SLIDE 61

Design

Evasion techniques

  • Observation:
  • ‘Match and forget’ behavior
  • Incomplete views of the connection
  • Inert packet insertion* : Traffic processed only by a classifier but not endpoint

13

* Christian Kreibich et al. 2001. Network intrusion detection: Evasion, traffic normalization, and end-to-end protocol semantics.

Using a small TTL value

slide-62
SLIDE 62

Design

Evasion techniques

  • Observation:
  • ‘Match and forget’ behavior
  • Incomplete views of the connection
  • Inert packet insertion* : Traffic processed only by a classifier but not endpoint

13

* Christian Kreibich et al. 2001. Network intrusion detection: Evasion, traffic normalization, and end-to-end protocol semantics.

Using a small TTL value

App B is classified as App A

slide-63
SLIDE 63

Design

Evasion techniques

14

Fragmenting the IP packet

ACK SYN, ACK SYN TCP 80 TCP 80 TCP 80 IPID 1 OFF 0 GE IPID 1 OFF 2 T IPID 1 OFF 4 /A IPID 1 OFF 6 \r\n TCP 80 TCP 80 TCP 80 TCP 80

slide-64
SLIDE 64

Design

Evasion techniques

  • Observation:
  • Each packet is searched independently for matching contents

14

Fragmenting the IP packet

ACK SYN, ACK SYN TCP 80 TCP 80 TCP 80 IPID 1 OFF 0 GE IPID 1 OFF 2 T IPID 1 OFF 4 /A IPID 1 OFF 6 \r\n TCP 80 TCP 80 TCP 80 TCP 80

slide-65
SLIDE 65

Design

Evasion techniques

  • Observation:
  • Each packet is searched independently for matching contents
  • Splitting/Reordering: splitting the matching contents across multiple packets

14

Fragmenting the IP packet

ACK SYN, ACK SYN TCP 80 TCP 80 TCP 80 IPID 1 OFF 0 GE IPID 1 OFF 2 T IPID 1 OFF 4 /A IPID 1 OFF 6 \r\n TCP 80 TCP 80 TCP 80 TCP 80

slide-66
SLIDE 66

Design

Evasion techniques

  • Observation:
  • Each packet is searched independently for matching contents
  • Splitting/Reordering: splitting the matching contents across multiple packets

14

Fragmenting the IP packet

ACK SYN, ACK SYN TCP 80 TCP 80 TCP 80 IPID 1 OFF 0 GE IPID 1 OFF 2 T IPID 1 OFF 4 /A IPID 1 OFF 6 \r\n TCP 80 TCP 80 TCP 80 TCP 80

slide-67
SLIDE 67

Design

Evasion techniques

  • Observation:
  • Each packet is searched independently for matching contents
  • Splitting/Reordering: splitting the matching contents across multiple packets

14

Fragmenting the IP packet

ACK SYN, ACK SYN TCP 80 TCP 80 TCP 80 IPID 1 OFF 0 GE IPID 1 OFF 2 T IPID 1 OFF 4 /A IPID 1 OFF 6 \r\n TCP 80 TCP 80 TCP 80 TCP 80

App A is unclassified

slide-68
SLIDE 68

Design

Evasion techniques

15

Inserting large delays

ACK SYN, ACK SYN TCP 80 TCP 80 TCP 80 TCP 80 SEQ 1 GET /B

slide-69
SLIDE 69

Design

Evasion techniques

  • Observation:
  • Classifiers do no retain classification results indefinitely

15

Inserting large delays

ACK SYN, ACK SYN TCP 80 TCP 80 TCP 80 TCP 80 SEQ 1 GET /B

slide-70
SLIDE 70

Design

Evasion techniques

  • Observation:
  • Classifiers do no retain classification results indefinitely
  • Flushing: causing the classifier to remove the classification state for the flow

15

Inserting large delays

ACK SYN, ACK SYN TCP 80 TCP 80 TCP 80 TCP 80 SEQ 1 GET /B

slide-71
SLIDE 71

Design

Evasion techniques

  • Observation:
  • Classifiers do no retain classification results indefinitely
  • Flushing: causing the classifier to remove the classification state for the flow

15

Inserting large delays

ACK SYN, ACK SYN TCP 80 TCP 80 TCP 80 TCP 80 SEQ 1 GET /B

slide-72
SLIDE 72

Design

Evasion techniques

  • Observation:
  • Classifiers do no retain classification results indefinitely
  • Flushing: causing the classifier to remove the classification state for the flow

15

Inserting large delays

ACK SYN, ACK SYN TCP 80 TCP 80 TCP 80 TCP 80 SEQ 1 GET /B

App B is unclassified

slide-73
SLIDE 73

Outline

  • Design and implementation
  • Traffic-classification rules detection
  • Evasion techniques
  • Implementation
  • Evaluation
  • Effectiveness across multiple networks

16

slide-74
SLIDE 74

Implementation

17

liberate Proxy

Replay Server Server

App

slide-75
SLIDE 75

Implementation

  • Phase 1: liberate does the analysis using a replay server

17

liberate Proxy

Replay Server Server

App Phase 1

slide-76
SLIDE 76

Implementation

  • Phase 1: liberate does the analysis using a replay server

17

liberate Proxy

Replay Server Server

App Phase 1

Phase 1

slide-77
SLIDE 77

Implementation

  • Phase 1: liberate does the analysis using a replay server
  • Phase 2: liberate applies evasion technique to traffic in-flight

17

liberate Proxy

Replay Server Server

App Phase 1 Phase 2 Phase 2 liberate Proxy

Replay Server Server

App Phase 1 Phase 2 Phase 2

slide-78
SLIDE 78

Implementation

  • Phase 1: liberate does the analysis using a replay server
  • Phase 2: liberate applies evasion technique to traffic in-flight

17

liberate Proxy

Replay Server Server

App Phase 1 Phase 2 Phase 2

liberate Proxy

Replay Server Server

App Phase 1 Phase 2 Phase 2

Phase 2

Phase 1

slide-79
SLIDE 79

Outline

  • Design and implementation
  • Traffic-classification rules detection
  • Evasion techniques
  • Implementation
  • Evaluation
  • Effectiveness across multiple networks

18

slide-80
SLIDE 80

Evaluation

Testbed and in the wild

19

liberate

Client Server

slide-81
SLIDE 81

Evaluation

Testbed and in the wild

19

  • Testbed evaluation

liberate

Client Server

slide-82
SLIDE 82

Evaluation

Testbed and in the wild

19

  • Testbed evaluation
  • Evaluation “in the wild”

liberate

Client Server

liberate

Client Server

slide-83
SLIDE 83

Evaluation

Testbed and in the wild

19

  • Testbed evaluation
  • Evaluation “in the wild”

liberate

Client Server

liberate

Client Server

slide-84
SLIDE 84

Evaluation

Testbed and in the wild

19

  • Testbed evaluation
  • Evaluation “in the wild”

liberate

Client Server

liberate

Client Server

slide-85
SLIDE 85

Evaluation

Results

20

slide-86
SLIDE 86

Evaluation

Example result table

21

Technique Test case 1 Example technique Inert packet insertion IP Lower TTL to only reach classifier TCP Wrong sequence number UDP Wrong checksum Payload Splitting Payload Reordering Reverse the transmission of first two fragments Classification flushing

slide-87
SLIDE 87

Evaluation

Example result table

21

Technique Test case 1 Example technique Inert packet insertion IP Lower TTL to only reach classifier TCP Wrong sequence number UDP Wrong checksum Payload Splitting Payload Reordering Reverse the transmission of first two fragments Classification flushing

slide-88
SLIDE 88

Evaluation

Example result table

21

Technique Test case 1 Example technique Inert packet insertion IP Lower TTL to only reach classifier TCP Wrong sequence number UDP Wrong checksum Payload Splitting Payload Reordering Reverse the transmission of first two fragments Classification flushing

slide-89
SLIDE 89

Evaluation

Example result table

21

Technique Test case 1 Example technique Inert packet insertion IP Lower TTL to only reach classifier TCP Wrong sequence number UDP Wrong checksum Payload Splitting Payload Reordering Reverse the transmission of first two fragments Classification flushing

slide-90
SLIDE 90

Evaluation

Testbed results

22

Technique Testbed Example technique Inert packet insertion IP Lower TTL to only reach classifier TCP Wrong sequence number UDP Wrong checksum Payload Splitting Break packet into two IP fragments Payload Reordering Reverse the transmission of first two fragments Classification flushing TTL-limited RST packet before classification

slide-91
SLIDE 91

Evaluation

Testbed results

22

Technique Testbed Example technique Inert packet insertion IP Lower TTL to only reach classifier TCP Wrong sequence number UDP Wrong checksum Payload Splitting Break packet into two IP fragments Payload Reordering Reverse the transmission of first two fragments Classification flushing TTL-limited RST packet before classification

  • Efficiency:
  • One-time overhead (phase 1) : 13 minutes
slide-92
SLIDE 92

Evaluation

Testbed results

22

Technique Testbed Example technique Inert packet insertion IP Lower TTL to only reach classifier TCP Wrong sequence number UDP Wrong checksum Payload Splitting Break packet into two IP fragments Payload Reordering Reverse the transmission of first two fragments Classification flushing TTL-limited RST packet before classification

  • Efficiency:
  • One-time overhead (phase 1) : 13 minutes
slide-93
SLIDE 93

Evaluation

Testbed results

22

Technique Testbed Example technique Inert packet insertion IP Lower TTL to only reach classifier TCP Wrong sequence number UDP Wrong checksum Payload Splitting Break packet into two IP fragments Payload Reordering Reverse the transmission of first two fragments Classification flushing TTL-limited RST packet before classification

  • Efficiency:
  • One-time overhead (phase 1) : 13 minutes
  • Run-time overhead (phase 2) : tens of bytes per flow
slide-94
SLIDE 94

Evaluation

Testbed results

22

Technique Testbed Example technique Inert packet insertion IP Lower TTL to only reach classifier TCP Wrong sequence number UDP Wrong checksum Payload Splitting Break packet into two IP fragments Payload Reordering Reverse the transmission of first two fragments Classification flushing TTL-limited RST packet before classification

  • Efficiency:
  • One-time overhead (phase 1) : 13 minutes
  • Run-time overhead (phase 2) : tens of bytes per flow
  • Effectiveness:
  • All types of techniques were effective in testbed
slide-95
SLIDE 95

Evaluation

T mobile ‘Binge On’

23

Technique Testbed T mobile Example technique

Inert packet insertion IP

Lower TTL to only reach classifier

TCP UDP Payload Splitting

Break packet into five TCP segments

Payload Reordering

Reverse the transmission of first two segments

Classification flushing

TTL-limited RST packet before classification

slide-96
SLIDE 96

Evaluation

T mobile ‘Binge On’

23

Technique Testbed T mobile Example technique

Inert packet insertion IP

Lower TTL to only reach classifier

TCP UDP Payload Splitting

Break packet into five TCP segments

Payload Reordering

Reverse the transmission of first two segments

Classification flushing

TTL-limited RST packet before classification

  • Classified video (HTTP/S) was throttled to 1.5 Mbps and zero-rated
  • Efficiency:
  • One-time overhead (phase 1) : 30 minutes
  • Run-time overhead (phase 2) : tens of bytes per flow
slide-97
SLIDE 97

Evaluation

T mobile ‘Binge On’

23

Technique Testbed T mobile Example technique

Inert packet insertion IP

Lower TTL to only reach classifier

TCP UDP Payload Splitting

Break packet into five TCP segments

Payload Reordering

Reverse the transmission of first two segments

Classification flushing

TTL-limited RST packet before classification

  • Classified video (HTTP/S) was throttled to 1.5 Mbps and zero-rated
  • Efficiency:
  • One-time overhead (phase 1) : 30 minutes
  • Run-time overhead (phase 2) : tens of bytes per flow
  • Effectiveness:
  • UDP traffic (e.g., Youtube video in QUIC) was not classified
slide-98
SLIDE 98

Evaluation

T mobile ‘Binge On’

23

Technique Testbed T mobile Example technique

Inert packet insertion IP

Lower TTL to only reach classifier

TCP UDP Payload Splitting

Break packet into five TCP segments

Payload Reordering

Reverse the transmission of first two segments

Classification flushing

TTL-limited RST packet before classification

  • Classified video (HTTP/S) was throttled to 1.5 Mbps and zero-rated
  • Efficiency:
  • One-time overhead (phase 1) : 30 minutes
  • Run-time overhead (phase 2) : tens of bytes per flow
  • Effectiveness:
  • UDP traffic (e.g., Youtube video in QUIC) was not classified
  • Breaking packet into 5 TCP segments evaded classification
slide-99
SLIDE 99

Evaluation

T mobile ‘Binge On’

23

Technique Testbed T mobile Example technique

Inert packet insertion IP

Lower TTL to only reach classifier

TCP UDP Payload Splitting

Break packet into five TCP segments

Payload Reordering

Reverse the transmission of first two segments

Classification flushing

TTL-limited RST packet before classification

  • Classified video (HTTP/S) was throttled to 1.5 Mbps and zero-rated
  • Efficiency:
  • One-time overhead (phase 1) : 30 minutes
  • Run-time overhead (phase 2) : tens of bytes per flow
  • Effectiveness:
  • UDP traffic (e.g., Youtube video in QUIC) was not classified
  • Breaking packet into 5 TCP segments evaded classification
  • Reversing the order of initial packets was effective
slide-100
SLIDE 100

Evaluation

T mobile ‘Binge On’

23

Technique Testbed T mobile Example technique

Inert packet insertion IP

Lower TTL to only reach classifier

TCP UDP Payload Splitting

Break packet into five TCP segments

Payload Reordering

Reverse the transmission of first two segments

Classification flushing

TTL-limited RST packet before classification

  • Classified video (HTTP/S) was throttled to 1.5 Mbps and zero-rated
  • Efficiency:
  • One-time overhead (phase 1) : 30 minutes
  • Run-time overhead (phase 2) : tens of bytes per flow
  • Effectiveness:
  • UDP traffic (e.g., Youtube video in QUIC) was not classified
  • Breaking packet into 5 TCP segments evaded classification
  • Reversing the order of initial packets was effective
slide-101
SLIDE 101

Evaluation

The Great Firewall of China

24

Technique Testbed T mobile GFC Example technique

Inert packet insertion IP

Lower TTL to only reach classifier

TCP

Wrong Checksum

UDP Payload Splitting Payload Reordering Classification flushing

Pause for t seconds before classification

slide-102
SLIDE 102

Evaluation

The Great Firewall of China

24

Technique Testbed T mobile GFC Example technique

Inert packet insertion IP

Lower TTL to only reach classifier

TCP

Wrong Checksum

UDP Payload Splitting Payload Reordering Classification flushing

Pause for t seconds before classification

  • Classified HTTP content was blocked by 3-5 RST packets
  • Efficiency:
  • One-time overhead (phase 1) : 20 minutes
  • Run-time overhead (phase 2) : tens of bytes per flow
slide-103
SLIDE 103

Evaluation

The Great Firewall of China

24

Technique Testbed T mobile GFC Example technique

Inert packet insertion IP

Lower TTL to only reach classifier

TCP

Wrong Checksum

UDP Payload Splitting Payload Reordering Classification flushing

Pause for t seconds before classification

  • Classified HTTP content was blocked by 3-5 RST packets
  • Efficiency:
  • One-time overhead (phase 1) : 20 minutes
  • Run-time overhead (phase 2) : tens of bytes per flow
  • Effectiveness:
  • Both IP/ TCP inert insertion succeeded
slide-104
SLIDE 104

Evaluation

The Great Firewall of China

24

Technique Testbed T mobile GFC Example technique

Inert packet insertion IP

Lower TTL to only reach classifier

TCP

Wrong Checksum

UDP Payload Splitting Payload Reordering Classification flushing

Pause for t seconds before classification

  • Classified HTTP content was blocked by 3-5 RST packets
  • Efficiency:
  • One-time overhead (phase 1) : 20 minutes
  • Run-time overhead (phase 2) : tens of bytes per flow
  • Effectiveness:
  • Both IP/ TCP inert insertion succeeded
  • Flushing classification by pausing succeeded
slide-105
SLIDE 105

Evaluation

The Great Firewall of China

24

Technique Testbed T mobile GFC Example technique

Inert packet insertion IP

Lower TTL to only reach classifier

TCP

Wrong Checksum

UDP Payload Splitting Payload Reordering Classification flushing

Pause for t seconds before classification

  • Classified HTTP content was blocked by 3-5 RST packets
  • Efficiency:
  • One-time overhead (phase 1) : 20 minutes
  • Run-time overhead (phase 2) : tens of bytes per flow
  • Effectiveness:
  • Both IP/ TCP inert insertion succeeded
  • Flushing classification by pausing succeeded
slide-106
SLIDE 106

Evaluation

The Great Firewall of China

25

Time-of-day effects when flushing classification

slide-107
SLIDE 107

Evaluation

The Great Firewall of China

25

Time-of-day effects when flushing classification

slide-108
SLIDE 108

Evaluation

The Great Firewall of China

25

Time-of-day effects when flushing classification

slide-109
SLIDE 109

Evaluation

The Great Firewall of China

25

Time-of-day effects when flushing classification

2:30 AM 60 seconds successfully evaded

slide-110
SLIDE 110

Evaluation

The Great Firewall of China

25

Time-of-day effects when flushing classification

2:30 AM 60 seconds successfully evaded 4:00 AM 240 seconds failed to evade

slide-111
SLIDE 111

Evaluation

The Great Firewall of China

25

Time-of-day effects when flushing classification

slide-112
SLIDE 112

Evaluation

The Great Firewall of China

25

Time-of-day effects when flushing classification

quiet hours (4:00 AM to 9:00 AM) — using long delays did not evade

slide-113
SLIDE 113

Evaluation

The Great Firewall of China

25

Time-of-day effects when flushing classification

quiet hours (4:00 AM to 9:00 AM) — using long delays did not evade busy hours (3:00 PM to 10:00 PM) — using short delays evaded

slide-114
SLIDE 114

Conclusion

  • A tool that automatically and efficiently evades differentiation
  • A taxonomy of evasion techniques
  • An empirical measurement of traffic classifiers
  • liberate evaded classifiers with low run-time overhead
  • Public, open-source tools and datasets
  • Future work: more resilient evasion techniques

26

slide-115
SLIDE 115

Thanks

For more details about liberate, code, and data :
 http://dd.meddle.mobi/liberate

27