CorrForce: A Scalable Live Traffic Correlation System

November 7, 2024

The increasing use of anonymity and privacy-preserving network systems like Tor and VPNs presents significant challenges for authorities investigating unlawful communications. One approach to address this is using correlation techniques to match client traffic with traffic observed on malicious servers. However, these networks are complex and generate large data volumes. Existing correlation models are limited by their focus on single use cases and reliance on static datasets, which restricts real-world effectiveness and adaptability to network changes. We propose CorrForce, a system that enhances live traffic correlation by enabling Internet Service Providers (ISPs) to actively capture and categorize traffic traces, improving the efficiency of efforts such as Tor de-anonymization and VPN detection. This thesis demonstrates the effectiveness of CorrForce through a use case focused on correlating Tor traffic to de-anonymize sessions between Tor clients and Onion Services, utilizing the SUMo correlation model. CorrForce also facilitates ISP collaboration by offering a novel, distributed, live, and query-based framework that integrates different correlation models using industry-standard frameworks like Kafka and Spark Structured Streaming. Key contributions include developing a comprehensive system architecture for CorrForce, introducing a new query language to specify flow correlation requests, and creating a prototype capable of executing these queries using SUMo over simulated Tor traffic.

Authors in the community:

• 

  J

  João Pedro Antunes Aragonez

  ist195606

Supervisors of this institution:

• 

  N

  Nuno Miguel Carvalho dos Santos

  ist14261

electrical-engineering-electronic-engineering-information-engineering - Electrical engineering, electronic engineering, information engineering

eng - English

Instituto Superior Técnico