Anonymization of traffic patterns over communication networks

• US 10,057,146 B2
• Filed: 04/11/2017
• Issued: 08/21/2018
• Est. Priority Date: 10/07/2015
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Acharya, Arup, Kundu, Ashish
• Primary Examiner(s): Najjar, Saleh
• Assistant Examiner(s): Mejia, Feliciano S
• Application Number:
  US15/484,162
• Publication Number:
  US 20170222898A1
• Time in Patent Office: 497 Days
• Field of Search: 726 23, 726 37
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
• CPC Class Codes: H04L 45/306 Route determination based on the nature of the carried application
• CPC Class Codes: H04L 45/70 Routing based on monitoring results
• CPC Class Codes: H04L 63/0421 Anonymous communication, i.e. the party's identifiers are hidden from the other party or parties, e.g. using an anonymizer
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1475 Passive attacks, e.g. eavesdropping or listening without modification of the traffic monitored
• CPC Class Codes: H04L 65/1069 Session establishment or de-establishment
• CPC Class Codes: H04L 65/1104 Session initiation protocol [SIP]
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/148 Migration or transfer of sessions

Abstract

A computer-implemented method of obfuscating communication traffic patterns may include detecting, at a first communications device, data communication sessions with a second communications device via the computer server using a network protocol. At the first device, a first traffic pattern is accessed based on the data communication sessions over a first predefined time period. At the first communications device, a second traffic pattern is accessed based on the data communication sessions over a second predefined time period that occurs after the first predefined time period. At the first communications device, based on a randomization process, a dummy data communication pattern is generated for transmission to the second communication devices, whereby the dummy data communication pattern is appended to the second traffic pattern for obfuscating a traffic pattern change between the first and the second traffic pattern at the computer server used to establish the communication sessions.

Claims

1. A computer-implemented method of obfuscating communication traffic patterns between a first communication device and a second communication device occurring over a communication infrastructure including a computer server, the computer-implemented method comprising:

accessing, at the first communications device, a first traffic pattern including communication occurrences between the first and the second communication devices over a first predefined time period;

accessing, at the first communications device, a second traffic pattern including occurrences between the first and the second communications devices over a second predefined time period that occurs after the first predefined time period; and

generating, at the first communications device, based on a randomization process, a dummy data communication pattern for transmission to the second communications device, wherein the dummy data communication pattern is appended to the second traffic pattern for obfuscating a traffic pattern change between the first and the second traffic pattern, wherein generating the dummy data communication pattern comprises;

determining, at the first communications device, a first information content value associated with the first traffic pattern and a second information content value associated with the second traffic pattern;

comparing, at the first communications device, the first and the second information content values; and

generating a first binary value based on the second information content value being outside a predefined threshold range of the first information content value.

2. The computer-implemented method of claim 1, wherein the dummy data communication pattern comprises one or more randomly generated binary values based on the randomization process, wherein the one or more randomly generated binary values include a binary ‘

1’

value or a binary ‘

0’

value, the binary ‘

1’

value establishing a dummy communication session between the first and the second communications devices, and the binary ‘

0’

value restricting a communication session between the first and the second communications devices.

3. The computer-implemented method of claim 1, further comprising:

determining, at the first communications device, a third information content value associated with a third traffic pattern including the second traffic pattern and the first binary value; and

comparing, at the first communications device, the first and the third information content values; and

generating a second binary value based on the third information content value being outside the predefined threshold range of the first information content value.

4. The computer-implemented method of claim 1, wherein:

the first binary value includes a binary ‘

1’

value or a binary ‘

0’

value, the binary ‘

1’

value establishing a dummy communication session between the first and the second communication devices, and the binary ‘

0’

value restricting a communication session between the first and the second communication devices.

5. The computer-implemented method of claim 3, wherein:

the second binary value includes a binary ‘

1’

value or a binary ‘

0’

value, the binary ‘

1’

value establishing a dummy communication session between the first and the second communication devices, and the binary ‘

0’

value restricting a communication session between the first and the second communication devices.

6. The computer-implemented method of claim 3, further comprising:

providing a first binary string having a predetermined length of bits, wherein each bit of the first binary string represents a communication status at a time interval within the first predefined time period; and

providing a second binary string having the predetermined length of bits, wherein each bit of the second binary string represents a communication status at a time interval within the second predefined time period.

7. The computer-implemented method of claim 6, wherein the communication status associated with the first traffic pattern comprises:

a binary value of ‘

1’

that is indicative of an occurred data communication session between the first and the second communications device via the computer server during the first predefined time period; and

a binary value of ‘

0’

that is indicative of a non-occurred data communication session between the first and the second communications device via the computer server during the first predefined time period.

8. The computer-implemented method of claim 6, wherein the communication status associated with the second traffic pattern comprises:

a binary value of ‘

1’

that is indicative of an occurred data communication session between the first and the second communications device via the computer server during the second predefined time period; and

a binary value of ‘

0’

that is indicative of a non-occurred data communication session between the first and the second communications device via the computer server during the second predefined time period.

9. The computer-implemented method of claim 6, wherein:

determining the first information content value associated with the first traffic pattern comprises calculating a first entropy value for the first binary string, and wherein;

determining the second information content value associated with the second traffic pattern comprises calculating a second entropy value for the second binary string, and wherein;

determining the third information content value associated with the third traffic pattern comprises calculating a third entropy value for a third binary string, the third binary string including the second binary string and the first binary value appended to the second binary string.

10. The computer-implemented method of claim 1, further comprising:

applying statistical analysis and learning to the first and the second accessed traffic patterns, wherein based on the statistical analysis, a determination corresponding to applying another obfuscation process to another traffic pattern is made.

11. The computer-implemented method of claim 1, wherein accessing the first traffic pattern and the second traffic pattern at the first communication device comprises:

accessing the first traffic pattern and the second traffic pattern from a telecommunication application executing on the first communication device.

12. A computer system for obfuscating communication traffic patterns between a first communication device and a second communication device occurring over a cloud-based communication infrastructure including a computer server, the computer system comprising:

one or more processors, one or more computer-readable memories, one or more non-transitory computer-readable storage devices, and program instructions stored on at least one of the one or more non-transitory storage devices for execution by at least one of the one or more processors via at least one of the one or more memories, wherein the computer system is capable of performing a method comprising;

accessing, at the first communications device, a first traffic pattern including communication occurrences between the first and the second communication devices over a first predefined time period;

accessing, at the first communications device, a second traffic pattern including occurrences between the first and the second communications devices over a second predefined time period that occurs after the first predefined time period; and

generating, at the first communications device, based on a randomization process, a dummy data communication pattern for transmission to the second communications device, wherein the dummy data communication pattern is appended to the second traffic pattern for obfuscating a traffic pattern change between the first and the second traffic pattern, wherein generating the dummy data communication pattern comprises;

determining, at the first communications device, a first information content value associated with the first traffic pattern and a second information content value associated with the second traffic pattern;

comparing, at the first communications device, the first and the second information content values; and

generating a first binary value based on the second information content value being outside a predefined threshold range of the first information content value.

13. The computer system of claim 12, wherein the dummy data communication pattern comprises one or more randomly generated binary values based on the randomization process, wherein the one or more randomly generated binary values include a binary ‘

1’

value or a binary ‘

0’

value, the binary ‘

1’

value establishing a dummy communication session between the first and the second communications devices, and the binary ‘

0’

value restricting a communication session between the first and the second communications devices.

14. The computer system of claim 12, further comprising:

determining, at the first communications device, a third information content value associated with a third traffic pattern including the second traffic pattern and the first binary value; and

comparing, at the first communications device, the first and the third information content values; and

generating a second binary value based on the third information content value being outside the predefined threshold range of the first information content value.

15. The computer system of claim 12, wherein:

the first binary value includes a binary ‘

1’

value or a binary ‘

0’

value, the binary ‘

1’

value establishing a dummy communication session between the first and the second communication devices, and the binary ‘

0’

value restricting a communication session between the first and the second communication devices.

16. The computer system of claim 14, further comprising:

providing a first binary string having a predetermined length of bits, wherein each bit of the first binary string represents a communication status at a time interval within the first predefined time period; and

providing a second binary string having the predetermined length of bits, wherein each bit of the second binary string represents a communication status at a time interval within the second predefined time period.

17. The computer system of claim 16, wherein the communication status associated with the first traffic pattern comprises:

a binary value of ‘

1’

that is indicative of an occurred data communication session between the first and the second communications device via the computer server during the first predefined time period; and

a binary value of ‘

0’

that is indicative of a non-occurred data communication session between the first and the second communications device via the computer server during the first predefined time period.

18. The computer system of claim 16, wherein the communication status associated with the second traffic pattern comprises:

a binary value of ‘

1’

that is indicative of an occurred data communication session between the first and the second communications device via the computer server during the second predefined time period; and

a binary value of ‘

0’

that is indicative of a non-occurred data communication session between the first and the second communications device via the computer server during the second predefined time period.

19. The computer system of claim 16, wherein:

determining the first information content value associated with the first traffic pattern comprises calculating a first entropy value for the first binary string, and wherein;

determining the second information content value associated with the second traffic pattern comprises calculating a second entropy value for the second binary string, and wherein;

determining the third information content value associated with the third traffic pattern comprises calculating a third entropy value for a third binary string, the third binary string including the second binary string and the first binary value appended to the second binary string.

20. The computer system of claim 12, further comprising:

applying statistical analysis and learning to the first and the second accessed traffic patterns, wherein based on the statistical analysis, a determination corresponding to applying another obfuscation process to another traffic pattern is made.