Tracing HTTP activity through non-cooperating HTTP proxies (short paper)

Authors:
Richard J. Edell;Peter Kruus;Uri Meth
Affiliations:
SPARTA, Inc., Columbia, MD;SPARTA, Inc., Columbia, MD;SPARTA, Inc., Columbia, MD
Venue:
ICICS'06 Proceedings of the 8th international conference on Information and Communications Security
Year:
2006

Citing 2
Cited 0

Statistical Identification of Encrypted Web Browsing Traffic

SP '02 Proceedings of the 2002 IEEE Symposium on Security and Privacy
Fingerprinting websites using traffic analysis

PET'02 Proceedings of the 2nd international conference on Privacy enhancing technologies

Quantified Score

Hi-index	0.00

Visualization

Abstract

Tracing nefarious HTTP activity to its source is sometimes extremely difficult when HTTP (and/or SOCKS) proxies are used for origin obfuscation. This paper describes a technique for tracing HTTP traffic through one or more non-cooperating HTTP (and/or SOCKS) proxies. The technique uses only passive observations of TCP/IP headers. Furthermore, the technique need only observe a single direction of the underlying TCP flows, i.e. the technique is asymmetric-route-robust. The technique represents a set of HTTP transactions as an activity profile. These profiles may be either distilled from passive network observations, or logged by a cooperating web server. Using statistical correlation techniques, we can trace both end-to-end SSL-encrypted HTTP, and unencrypted HTTP despite the source obfuscation methods employed by many contemporary proxies. The technique may be used to narrow the search space before applying other more resource intensive traceback techniques.