Core Illumination: Traffic Analysis in Cyberspace

The information security discipline devotes immense resources todeveloping and protecting a core set of protocols that encode and encryptInternet communications. However, since the dawn of human conflict, simple Traffic Analysis (TA) has been used to circumvent innumerable security schemes. TA leverages metadata and hard-to-conceal network flow data relatedto the source, destination, size, frequency, and direction of information, from which eavesdroppers can often deduce a comprehensive intelligenceanalysis. TA is effective in both the hard and soft sciences, and provides an edge in economic, political, intelligence, and military affairs. Today, modern information technology, including the ubiquity of computers,and the interconnected nature of cyberspace, has made TA a global and universally accessible discipline. Further, due to privacy issues, it is also a global concern. Digital metadata, affordable computer storage, and automated information processing now record and analyse nearly all human activities, and the scrutiny is growing more acute by the day. Corporate, lawenforcement, and intelligence agencies have access to strategic datasetsfrom which they can drill down to the tactical level at any moment. This paper discusses the nature of TA, how it has evolved in the Internet era, and demonstrates the power of high-level analysis based on a large cybersecurity dataset.

Presented by