Ideal Packet Length Masking against Traffic Classification

Traffic flow classification has been attracting an increasing interest. Among the exploited flow features, a key role is played by the sequence of packet lengths. We aim at understanding if and how complex it is to obfuscate this information, referred to as packet length masking. Masking can be obtained by means of padding and fragmenting. We define formally what the ideal target of masking is, and then define the masking problem as a statistical optimization problem, aiming at minimizing the required overhead. We find the optimal solution of the masking problem in case of two application types. An explicit efficient algorithm is given to compute the optimum masking sequence. Numerical results are provided, based on measured traffic traces of HTTP, POP3, SMTP, FTP-control and VoIP traffic. One of the most striking findings is that fragmenting does not achieve any significantly better performance than simple padding does as far as overhead-obfuscation trade-off is concerned.