#  SiamHAN: IPv6 Address Correlation Attacks on TLS Encrypted Traffic via
Siamese Heterogeneous Graph Attention Network

###### Abstract

The security and privacy consideration of IPv6 has constantly attracted the
attention of researchers due to the urgent requirement of the next-generation
Internet. The defense of user activity correlation is such a focus theme in
IPv6 networks. Unlike IPv4 users with the protection under wide-ranging
deployment of NAT, user activity correlation on IPv6 addresses could endanger
individual-level privacy for a long time. In order to address the problem,
past research works have introduced series of address-based mitigations and
widespread TLS encryption, making existing correlation attacks unreliable for
linking large-scale IPv6 users.

In this paper, we show that, unfortunately, an adversary could correlate IPv6
addresses and users with drastically high accuracy through emerging learning
mechanisms. We propose an IPv6 address correlation attack model SiamHAN. Using
the siamese heterogeneous graph attention network, we show SiamHAN could
measure whether two IPv6 client addresses belong to the same user even on TLS
encrypted traffic. We argue that, with moderate learning, SiamHAN could be
very helpful for user tracking and user discovery tasks. As we show in the
paper, using SiamHAN for the tasks of tracking target users and discovering
unique users, we can achieve a 99% and 88% accuracy, respectively. This
performance outperforms the state-of-the-art technique, which demonstrates
only 82% and 59% accuracy for the corresponding task. We argue that our
address correlation attack demonstrates a severe threat to IPv6 users’
privacy.

##  1 Introduction

IPv6 [deering2017internet] is the preparatory direction of the next-generation
network. Its robustness and security have always been a topic of extensive
discussion in the community. Due to overcrowding in the IPv4 address space,
network providers have accelerated the deployment of IPv6
[internetsociety2020world, SarrarMASU12], over the last decade, which
facilitates a dramatic increase of IPv6 users [CzyzAZIOB14, CzyzLMBKK13].
Today, a third of users now access online services using IPv6
[google2020ipv6]. The unprecedented number of IPv6 users reminds researchers
of the necessity for extensive research on security and privacy issues.
However, a body of work [BergerKP20, LiF20, CzyzLAB16] indicates that IPv6
networks still leave security flaws to be improved. Studies on the security
and privacy considerations of IPv6 are imperative to satisfy the community’s
concerns about the transition to IPv6.

One of the core problems on the considerations for security practitioners is
user activity correlation [rfc7721]. User activity correlation is an attack
leveraging the user-generated meta-information to identify and continuously
track users in the future effectively. Due to the vast benefits of websites or
third-party companies for personal interest collection, user activity
correlation is widely performed in web user tracking through HTTP cookies, and
browser fingerprinting [EnglehardtN16, Gomez-BoixLB18, PapadopoulosKM19].
However, a traffic-based correlation proved to reach a stronger correlation
and longer correlation time, employed in diverse correlation attack scenarios
[NasrBH18, BahramaliHSGT20, GonzalezSL16]. Among them, Transport Layer
Security (TLS) [rfc8446] traffic is the most commonly attacked object due to
the extensive deployment [KotziasRAPVC18]. The payload is effectively
encrypted in the application, while an adversary could extract traffic
characteristics of different dimensions to conduct the correlation. Although
user activity correlation could be applied to IPv4 and IPv6 users, a
correlation attack on IPv6 addresses keeps a serious individual-level privacy
threat due to the rare deployment of NAT (i.e., an IPv6 address usually
corresponds to one single user rather than a user group).

IPv6 user correlation on TLS encrypted traffic mainly includes address-based
correlation and traffic characteristic correlation. However, the improvement
of address-based mitigations and the challenge of user-level identification
prompt correlation attacks ineffective: (1) address-based correlation. The
considerable address space of IPv6 allows users to configure various
addressing schemes [rfc4291]. However, researchers have found that an IPv6
address with a weak configuration could easily be used to correlate seemingly
unrelated user activities in multiple contexts, for instance, customizing a
constant interface identifier in an address [rfc4862]. To mitigate this
problem, RFC 4291 [rfc4291] requires network operators to treat interface
identifiers as semantically opaque and RFC 4941 [rfc4941] proposes privacy
extensions for stateless address autoconfiguration (SLAAC) by using temporary
addresses in IPv6 networks. These measures effectively against address
structure analysis and even implement frequently changed pseudo-random
interface identifiers to eliminate address-based correlation threats. (2)
traffic characteristic correlation. While prior work has developed
sophisticated techniques for analyzing user activities from different
dimensions on encrypted traffic, including user profiling [GonzalezSL16,
KumpostM09], TLS fingerprinting [AndersonM17], and flow sequences [NasrBH18].
However, due to the poor knowledge description and the unreliable similarity
learning, these approaches could only identify known users on a closed-world
scenario with limited datasets. In summary, IPv6 user traffic consists of
frequently transforming client addresses and widespread payload encryption,
which renders correlating IPv6 users completely infeasible.

In this paper, however, we take the user activity correlation on IPv6 networks
to reality. We define an IPv6 address correlation attack, i.e., based on the
TLS encrypted communication behavior of IPv6 addresses for a period of time as
the background knowledge, an adversary could learn a correlation function to
determine whether two arbitrary addresses belong to the same user. The attack
specifically includes two steps: (1) building knowledge graphs. By constantly
monitoring the TLS encrypted traffic on a vantage point, an adversary could
construct a knowledge graph for each address based on the communication
behavior of the IPv6 client address to learn the attack model. The knowledge
graph is a heterogeneous graph built from multiple types of meta-information
in TLS traffic, exploiting the complementarity of address-based correlation
and traffic characteristic correlation. (2) learning attack model. Following
the powerful performance of graph neural networks [WangJSWYCY19], and siamese
networks [ChopraHL05], we propose a siamese heterogeneous graph attention
network and its concrete instantiation SiamHAN to learn the correlation
function of IPv6 addresses with TLS encrypted traffic. SiamHAN employs multi-
level attention and metric learning to learn the graph-based IPv6 address
embeddings and measure the correlation between two arbitrary client addresses.

To evaluate the performance of SiamHAN, we collected 5 months of IPv6 user
traffic at a vantage observation point and labeled 2.6k addresses of 1.7k
users by using persistent cookies. By evaluating on 1.4M pair data composed of
every two addresses’ TLS traffic, SiamHAN could correlate the activities of
pairwise IPv6 addresses with 99% accuracy based on 1-month adversary’s
background knowledge. When applied to long-term user tracking and user
discovery tasks, SiamHAN outperforms existing correlation techniques by
significant margins. For instance, tracking target users or discovering unique
users with 99% or 88% accuracy with adversary’s background knowledge on a
real-world 5-month dataset, compared to 82% or 59% accuracy of the state-of-
the-art correlation system Deepcorr [NasrBH18].

Contributions. Our contributions can be summarized as:

  * •

We define the first IPv6 address correlation attack and threat model, i.e.,
effectively correlating user activities on TLS encrypted traffic with dynamic
client addresses, which takes a great threat to IPv6 user privacy.

  * •

We present a knowledge graph-based approach to model user behavior behind
addresses, which exploits multi-type semantic meta-information to help user
correlation.

  * •

We propose the correlation attack model SiamHAN, which shows powerful
performance on IPv6 user activity correlation through multi-level attention
mechanism and metric learning based on heterogeneous graph attention networks
and siamese networks.

  * •

We conduct extensive experiments on a 5-month IPv6 user TLS traffic dataset.
Results show that SiamHAN is robust and could reach drastically high
accuracies on multiple long-term user correlation tasks. We consider possible
countermeasures against the attack.

Roadmap. Section 2 summarizes the prior researches related to our work.
Section 3 introduces the threat model and the basic knowledge about IPv6
address correlation attacks. Section 4 highlights the overall design of
SiamHAN. Section 5 presents the main setting for experiments. Section 6 shows
the evaluation results and Section 7 discusses the mitigations against the
attack. Section 8 concludes the paper.

##  2 Related Work

Prior work on IPv6 user activity correlation falls into two categories: (1)
learning address structure to infer user address configuration schemes and (2)
extracting multiple dimensions of traffic characteristics to identify users.
In addition, we introduce (3) heterogeneous graph representation learning and
(4) metric learning, which is related to our attack model.

###  2.1 Address Structure Learning

RFC 7707 [rfc7707] points out known address configuration schemes and possible
administrator configuration customs. The measurement work in the document
indicates that most addresses follow specific patterns, which means that even
an address configuration with transform addresses, such as DHCPv6 [rfc8415],
may be compromised by address structure learning to narrow the target user
range. A body of work [ForemskiPB16, GasserSFLKSHC18, abs-2008-02213] could
even learn the addressing pattern through unsupervised clustering or neural
networks to facilitate active user discovery. However, RFC 4941 [rfc4941]
proposed a temporary address configuration scheme to replace the traditional
addressing with pseudo-random interface identifiers that change over time,
making it extremely difficult to identify users from the address structure.
Ullrich et al. [UllrichW15] analyzed the temporary address generation
algorithm and showed that it is possible to infer a user’s future temporary
addresses through long-term observations. Due to the observation must be
conducted on one single user host, address correlation with large-scale users
is still impossible to implement. Finally, RFC 7721 [rfc7721] discussed the
privacy and security considerations of the IPv6 address generation mechanism
and indicated that certain constant information associations might lead to
prolonging the observation time of temporary addresses. This is consistent
with the idea of our attack. Our work will complete long-term user activity
correlation through a combination of address structure learning and traffic
characteristics learning.

###  2.2 Traffic Characteristics Learning

Since the traffic contains multiple dimensions of user meta-information,
moderate learning on the traffic characteristics have proved powerful
performance in multiple tasks, including flow correlation [SunEVLRCM15,
NasrBH18], website fingerprinting [SirinamIJW18, Wang20, SirinamMR019], and
traffic classification [LiuHXCL19]. Prior work mainly learns user traffic
characteristics from three dimensions, including user profiling [GonzalezSL16,
KumpostM09], TLS fingerprinting [AndersonM17], flow sequences [NasrBH18]:

User Profiling. User profiling refers to using behavior-based statistical
features to construct a user profile. Kumpost et al. [KumpostM09] employed the
target IP address to create user profiles to identify these users in future
traffic. Banse et al. [HerrmannBF13] generate user profiles by collecting user
DNS requests and utilize a Bayesian classifier [0021593] to track users on the
university network. In the case of TLS traffic, Gonzalez et al. [GonzalezSL16]
showed that leveraging Server Name Indication (SNI) information could
effectively collect user online interests.

TLS Fingerprinting. TLS Fingerprinting is a technique that extracts parameters
from a TLS ClientHello to provide visibility into the application that creates
the session. Applications of TLS fingerprinting include malware detection
[AndersonPM18], operating system identification [AndersonM17], and client
identification [HusakCJC15]. Due to the difference in fingerprints of
different browsers, it is possible to distinguish users to a certain extent.
Several open-source databases have been released include [althouse2020ja3,
brotherston2020fingerprintls, majkowski2020ssl].

Flow Sequences. Flow sequence is the packet timings and packet sizes collected
during the user communications. Nasr et al. [NasrBH18] exploited flow
sequences to link the egress and ingress segments of a Tor connection. Liu et
al. [LiuHXCL19] could distinguish the application types of user-generated
traffic through these characteristics. These works show the effectiveness of
flow sequence for user activity identification.

While multi-dimension characteristics could be extracted in TLS encrypted
traffic, the complexity of user activity brings extreme difficulty when
applied on a large scale. Therefore, prior work is mainly performed on a
closed-world dataset, i.e., re-identifying training users on the test set. In
this work, we exploit graph-based user profiles to develop the correlation
attack model in IPv6 scenarios, which could achieve strong user correlation on
an open-world dataset for unknown users.

###  2.3 Heterogeneous Graph Embedding

Graph data is a powerful tool to model the complex relationships between
entities. Therefore, a family of machine learning techniques known as graph
neural networks (GNNs) [KipfW17, HamiltonYL17, VelickovicCCRLB18,
WangJSWYCY19] was proposed to analyze graphs. With the growing performance of
GNNs and considerable research interest, researchers are no longer satisfied
with the study on homogeneous graphs. The real-world graph usually comes with
multi-types of nodes and edges, also widely known as heterogeneous information
networks (HIN) [ShiLZSY17]. Because the heterogeneous graph contains more
comprehensive information and rich semantics, it has been widely used in many
data mining tasks [NiuLLXSDC20, WangCYLNTGLCY19]. For instance, Wang et al.
[WangJSWYCY19] proposed a heterogeneous graph attention network (HAN) to
provide powerful performance on node classification and clustering tasks. To
express the client’s activities in the traffic with sufficient semantic
information, we employ a heterogeneous graph as the knowledge of user
behavior. We then use a multi-level attention mechanism to learn the graph
embedding for correlation tasks.

###  2.4 Metric Learning

Metric learning, also known as distance metric learning, is to learn a
distance metric for the input space of data from a given collection of pair of
similar or dissimilar entities. The core idea of distance metric is applied by
many representative works, including KNN and SVM [WeinbergerBS05]. With the
development of deep learning, siamese networks [ChopraHL05] are proposed to
employ a pair of shared weight network architecture and contrastive loss
function to model the distance metric. The simplicity and extensibility of the
network structure lead the siamese network widely applied in computer vision
tasks, including face recognition [TaigmanYRW14] and object tracking
[HeLTZ18]. In this paper, we implement a siamese network framework based on
heterogeneous graph data, called SiamHAN, to acquire a reliable correlation
metric between IPv6 client addresses.

##  3 Preliminaries

This section proposes the threat model of IPv6 address correlation attacks and
a brief basic knowledge related to our attack model, including IPv6 addressing
and TLS communications, to help readers understand this paper.

Figure 1: The threat model of IPv6 address correlation attacks. The adversary
could collect IPv6 client addresses and their TLS traffic within time $t$ as
the background knowledge $\kappa_{t}$ to conduct correlation learning for user
tracking or user discovery.

###  3.1 Threat Model

Figure 1 shows the threat model of IPv6 address correlation attacks. In an
IPv6 network, $N$ IPv6 users may generate $C$ client addresses to access
online services within a period $t$. There usually is $|N|\leq|C|$ due to
frequent changes of the client addresses. However, the relationship between
users and addresses can not be detected using packet contents due to the use
of TLS encryption. For instance, $C_{i}$ and $C_{j}$ are two IPv6 addresses of
a user observed in the traffic during the period $t$. However, such
association cannot be detected by inspecting the packet contents of $C_{i}$
and $C_{j}$ due to TLS encryption.

The goal of an adversary is to correlate two arbitrary IPv6 addresses to
identify a unique user. In particular, the adversary could perform an IPv6
address correlation attack, i.e., based on the encrypted communication
behavior of all IPv6 addresses for a wiretapping time $t$ as the background
knowledge $\kappa_{t}$, the adversary could judge the relationship $R$ of a
pair of addresses $\langle C_{i},\,C_{j}\rangle$ through a correlation
function $f$:

$R=f(\,\langle C_{i},\,C_{j}\rangle\,|\,\kappa_{t}\,)$ (1)

The correlation function $f$ can be learned by an attack model providing the
distance metric for arbitrary pair of IPv6 addresses, which is used to
determine whether they belong to the same user through a threshold $\eta$.

To train the attack model, the adversary could utilize some tricks to obtain
the ground truth dataset, e.g., using leaked plaintext cookies. Although the
user data is protected by TLS encryption most of the time, a few users expose
their HTTP plaintext since they use the changing addresses and access some
websites without HTTPS deployment during adversary’s traffic monitoring. Then
the adversary could easily label the encryption connections of these addresses
through the plaintext cookies. It is worth noting that this situation could
only provide a small number of user labels and most users never reveal their
plaintext information. Once the attack model is learned, the adversary could
perform a large-scale correlation attack on the wild TLS traffic without
plaintext.

An IPv6 address correlation adversary can intercept network traffic at various
network locations. According to the different target user groups, these
locations could be relay routers, Autonomous systems (ASes), Internet exchange
points (IXPs), and website servers.

Since the IPv6 address correlation attack could model an association
relationship between any pair of addresses, we consider that the attack could
conduct user tracking and user discovery tasks on large-scale encrypted
traffic:

User Tracking. Based on the adversary’s background knowledge $\kappa_{t}$, a
limited number of target users’ one client address activity sample is known.
The adversary could correlate all addresses of the target users during the
period $t$ to achieve target user tracking, which is like a classification
task of classifying all collected samples into target user categories or no
correlation categories.

User Discovery. Based on the adversary’s background knowledge $\kappa_{t}$,
the number of users in traffic is unknown. The adversary could calculate the
correlation between every two addresses and acquire address clusters during
the period $t$ to realize user discovery, which is like a clustering task of
classifying all collected samples into unknown user categories.

###  3.2 IPv6 Addressing

An IPv6 address consists of a global routing prefix, a local subnet
identifier, and an interface identifier (IID) [rfc4291]. While the global
routing prefix is determined to route traffic destined to a Local Area Network
(LAN), the configuration of IID is allowed more freedom to ensure the
uniqueness of the host interface in the local network segment. RFC 7721
[rfc7721] considers the security and privacy of different address
configuration schemes. These schemes show varying degrees of privacy threats
in the face of address-based correlation:

  * •

Constant IID. An IPv6 interface identifier that is globally stable, i.e., the
IID will remain constant even if the node moves from one IPv6 link to another,
which could be generated through IEEE identifier [rfc4862] or static, manual
configuration and be used to correlate activities for the device lifetime or
the address lifetime.

  * •

Stable IID. An IPv6 interface identifier that is stable per IPv6 link, i.e.,
the IID will remain unchanged as long as the node stays on the same IPv6 link
but may change when the node moves from one IPv6 link to another, which is
described in RFC 7217 [rfc7217] and could be used to correlate activities
within single IPv6 link.

  * •

Temporary IID. An IPv6 interface identifier that varies over time. The IID
could be generated through SLAAC privacy extension [rfc4941], or DHCPv6
[rfc8415], which could only be tracked for the temp address lifetime.

Therefore, address-based correlation attacks are usually effective on an
address with a constant or stable interface identifier while unachievable on a
temporary address. Correlation techniques are required more meta-information
to overcome dynamic address transform.

(a) Node $C$

(b) Nodes $S$ and $SCS$ meta-paths

(c) Nodes $F$ and $FCF$ meta-paths

(d) Nodes $F$ and $FSF$ meta-paths

Figure 2: The building process of the knowledge graph on one IPv6 client
address.

###  3.3 TLS Communications

TLS [rfc8446] is an encryption protocol designed to secure Internet
communications. Whenever a user navigates to a website over HTTPS, the TLS
encryption of the traffic payload effectively protects user privacy from
malicious analysis. However, before the encrypted communications, a TLS
handshake is required to exchange several messages to establish the two
communicating sides, which includes considerable available meta-information to
infer activities. For instance:

  * •

ClientHello message. The client initiates the handshake by sending a
ClientHello message to the server. The message includes which TLS version the
client supports, the cipher suites supported, the compression methods
supported, a client random string, and extensions field. Clients may request
extended functionality from servers by sending data in the extensions field,
like specifying Server Name Identifier (SNI) to prevent common name mismatch
errors.

  * •

ServerHello message. In reply to the ClientHello message, the server sends a
ServerHello message containing a server random string, extensions, the
server’s chosen TLS version, cipher suite, and compression method.

  * •

Certificate message. The Certificate message will always immediately follow
the ServerHello message when required certificates for authentication, which
conveys the server’s certificate chain to the client. The certificate also
contains the meta-information related to the server, such as issuer and
subject.

To help readers understand this paper, we provide the notions of the TLS
fields related to the paper in Table 1. Based on the meta-information proposed
from the TLS communications, a user’s communication activities could be
learned due to the client’s exposure and server-related information in the
session. However, complex user activities and considerable field information
render correlation attacks infeasible in multiple contexts. Advanced traffic
characteristic correlation techniques must focus on favorable information to
facilitate effective user correlation.

Table 1: Notions of the TLS fields used in the paper. Field Name | Notion
---|---
Record version | The version of the TLS protocol
| employed in the Record Layer.
Client version | The version of the TLS protocol by
| which the client wishes to communicate.
Server version | The version of the TLS protocol
| finally chosen by the server.
Cipher suites | A list of the cryptographic options
| supported in the ClientHello or the single
| cipher suite selected in the Server Hello.
Compression | A list of the compression methods
| supported in the ClientHello or the single
| method selected in the ServerHello.
SNI | The domain name specified by the client
| to reach in the ClientHello extensions.
Algorithm ID | The identifier for the cryptographic
| algorithm used to sign the certificate.
Issuer | The entity that has signed and issued the
| certificate in the Certificate message.
Subject | The entity associated with the public
| key stored in the Certificate message.

##  4 Design of SiamHAN

This section introduces our IPv6 address correlation attack system, called
SiamHAN, which is a two-step attack, including building knowledge graphs and
learning attack models.

###  4.1 Knowledge Graph

When chronically intercepting network traffic on the victim router or server,
the adversary could collect considerable meta-information about the client
address communication, which could be reconstructed to help identify the user.
To achieve this goal on the IPv6 network, we construct a knowledge graph based
on TLS encrypted communication for each IPv6 client address as the adversary’s
background knowledge $\kappa_{t}$. Since the user’s complex online behavior
will generate diverse semantic data during the adversary’s wiretapping time
$t$, we use a heterogeneous graph [SunH12] to model the knowledge graph. The
graph contains multi-type nodes and neighbor relationships to describe the
user activities behind the address accurately. Figure 2 shows the structure of
the knowledge graph.

Nodes and Node Attributes. Based on the adversary’s background knowledge
$\kappa_{t}$, the knowledge graph of each IPv6 client address contains three
types of nodes, including a client node $C$, server nodes $S$, and fingerprint
nodes $F$, which are shown in Table 2. Each graph node keeps an attribute to
represent the meaning of the node:

  * •

Client nodes $C$. The client node models an IPv6 client address monitored
within time $t$, whose attribute is the 32-bit hexadecimal IPv6 client
address. Each knowledge graph contains only one client node to denote the
meta-information related to it.

  * •

Server nodes $S$. The server nodes are all IPv6 server addresses that have
established TLS communications with the client address, whose attribute is the
32-bit hexadecimal IPv6 server address.

  * •

Fingerprint nodes $F$. The fingerprint nodes include client fingerprints and
server fingerprints, whose attributes are field values of the ClientHello,
ServerHello, Certificate messages, and statistical characteristics in the TLS
connection established with the client address. Following the work of
[althouse2020ja3, brotherston2020fingerprintls, majkowski2020ssl], we intend
to select the commonly used, distinguishable TLS fields for model learning. In
addition, the statistical characteristics provide a more detailed description
of the user behavior. The first connection refers to the date of the first
time the client accesses the server. Flow count records the number of the flow
generated during the communication.

Because the attributes of these nodes integrate address and traffic
characteristic meta-information, the adversary could learn user activities
based on the knowledge of address structure and traffic characteristic
correlation.

Neighbor Relationships. In a heterogeneous graph, nodes can be connected via
different semantic paths, which are called meta-paths [SunHYYW11]. To denote
the neighbor relationship of different semantics, we propose three types of
meta-paths to connect three types of nodes in the knowledge graph, including
$SCS$ meta-path, $FCF$ meta-path, and $FSF$ meta-path:

  * •

$SCS$ meta-path. The $SCS$ meta-path connects the client node $C$ and multiple
server nodes $S$, representing the TLS communication activities between the
client and multiple servers.

  * •

$FCF$ meta-path. The $FCF$ meta-path connects the client node $C$ and multiple
client fingerprint nodes $F$, representing the browser parameters that may be
used behind the client.

  * •

$FSF$ meta-path. The $FSF$ meta-path connects each server node $S$ and
multiple server fingerprint nodes $F$ related to the server, which denotes the
characteristics and user accessing habits of the service behind each server.

Table 2: Nodes detail in the knowledge graph. Node Type | Source | Label | Node Attribute
---|---|---|---
Client node | IPv6 header | $C$ | Client address
Server node | IPv6 header | $S$ | Server address
| ClientHello | $F_{1}$ | Record version
Client | $F_{2}$ | Client version
fingerprint | $F_{3}$ | Cipher suites
| $F_{4}$ | Compression
| ClientHello | $F_{5}$ | SNI
|  | $F_{6}$ | Record version
| ServerHello | $F_{7}$ | Server version
Server |  | $F_{8}$ | Cipher suite
fingerprint |  | $F_{9}$ | Algorithm ID
| Certificate | $F_{10}$ | Issuer
|  | $F_{11}$ | Subject
| Date statistics | $F_{12}$ | First connection
| Count statistics | $F_{13}$ | Flow count

The $FCF$ meta-path and $FSF$ meta-path can be effectively exploited to learn
unique client and service representations. The $SCS$ meta-path exposes the
communication activities between the user’s client and each service, thus
facilitating reliable correlation attacks.

It is worth noting that, since the user may use multiple browsers, the same
type of client fingerprint may contain multiple nodes, e.g., two client
fingerprint nodes with different Cipher suites attributes are included in one
knowledge graph. In addition, since a TLS connection may not contain all three
types of messages, a server node could lack some server fingerprints, leaving
a smaller count of the $FSF$ based neighbors.

Figure 3: The overall architecture of SiamHAN. SiamHAN inputs pairwise client
addresses’ knowledge graphs to learn their correlation. The multi-level
attention mechanism helps match the similar features between the two
heterogeneous graphs to learn their graph embeddings. The siamese network
finally metric the distance of the embeddings to judge the correlation
relationship.

###  4.2 Model Architecture

SiamHAN is a deep learning framework shown in Figure 3, which exploits the
heterogeneous graph attention network-based siamese network architecture to
learn the address correlation. The architecture could be divided into four
objectives: node-level attention, semantic-level attention, graph-level
attention, and metric learning with siamese network.

After constructing a knowledge graph for each client address, the adversary
could select any two knowledge graphs to model their association and infer
whether they are bound to the same user. Each knowledge graph could extract an
adjacency matrix $A$ and feature matrix $X$ to be processed by the GNNs, where
the adjacency matrix $A$ includes the neighbor relationships of each node and
the feature matrix $X$ is the attribute value of all nodes. A GNN method
iteratively updates a node’s features via aggregating its neighbors’ features.
SiamHAN uses self-attention [VaswaniSPUJGKP17] with multiple levels to update
a pair of feature matrix $X_{i}$ and $X_{j}$ according to the adjacency matrix
$A_{i}$ and $A_{j}$ and obtain their network embeddings to measure the
distance of the two addresses for correlation.

Node-level Attention. For each pair of input knowledge graphs, the node-level
attention first learns the weights of meta-path based neighbors and aggregate
them to get the semantic-specific node embedding. Given $N_{u}^{\Phi}$ denotes
the meta-path $\Phi$ based neighbors of node $u$ (include itself) and node
$v\in N_{u}^{\Phi}$, the importance of meta-path based node pair $\langle
u,v\rangle$ can be formulated as follows:

$\begin{gathered}e_{uv}^{\Phi}=\sigma(a_{\Phi}^{T}\cdot[h_{u}||h_{v}]),\\\
\alpha_{uv}^{\Phi}={\rm softmax_{v}}(e_{uv}^{\Phi})=\frac{{\rm
exp}(e_{uv}^{\Phi})}{\sum_{k\in N_{u}^{\Phi}}{\rm
exp}(e_{uk}^{\Phi})},\end{gathered}$ (2)

where $h_{u}$ and $h_{v}$ are the features of node $u$ and $v$, $a_{\Phi}$ is
the node-level attention parametrize matrix for meta-path $\Phi$, $\sigma$
denotes the activation function, and || denotes the concatenate operation.
Since the attack model inputs pairwise user meta-information, a higher weight
coefficient $\alpha_{uv}^{\Phi}$ indicates matching similar neighbor data in a
single meta-path based semantic in the two knowledge graph, which contributes
to the correlation task. For instance, the two client nodes in the pairwise
graph link to the same server nodes based on $\Phi_{SCS}$.

Then, the meta-path based embedding of node $u$ can be obtained by aggregating
all neighbor attributes with the corresponding coefficients as follows:

$z_{u}^{\Phi}=\Big{\|}_{k=1}^{K}\sigma\Big{(}\sum_{v\in
N_{u}^{\Phi}}\alpha_{uv}^{\Phi}\cdot h_{v}\Big{)},$ (3)

where $z_{u}^{\Phi}$ is the learned embedding of node $u$ for the meta-path
$\Phi$, $K$ is the head number using the multi-head attention mechanism
[VaswaniSPUJGKP17]. Among the three types of meta-path in our work, $FCF$ and
$FSF$ promote learning the unique client and server service embeddings based
on the client and server fingerprints, while $SCS$ mines the user activity
representation using the communication relationship.

Semantic-level Attention. After feeding node features into node-level
attention with the meta-path set $M=\\{\Phi_{FCF},\Phi_{FSF},\Phi_{SCS}\\}$,
the semantic-level attention is required to learn the importance of three
types of semantic-specific embeddings and fuse them as a comprehensive node
embedding. The importance of meta-path $\Phi_{i}$ based embedding is shown as
follows:

$\begin{gathered}w_{\Phi_{i}}=\frac{1}{|V|}\sum_{u\in V}p^{T}\cdot{\rm
tanh}(W_{s}\cdot z_{u}^{\Phi_{i}}+b_{s}),\\\ \beta_{\Phi_{i}}={\rm
softmax_{i}}(w_{\Phi_{i}})=\frac{{\rm exp}(w_{\Phi_{i}})}{\sum_{\Phi_{i}\in
M}{\rm exp}(w_{\Phi_{i}})},\end{gathered}$ (4)

where $W_{s}$ is the weight matrix, $b_{s}$ is the bias vector, and $p$ is the
semantic-level attention parametrize matrix. $V$ is the node-set of the input
knowledge graph. Since we average the importance of all the semantic-specific
node embedding, the weight coefficient $\beta_{\Phi_{i}}$ could be interpreted
as the contribution of the meta-path $\Phi_{i}$ for the correlation task.

With the learned weights of each semantic-specific embedding, the
comprehensive embedding $s_{u}$ of node $u$ could be:

$s_{u}=\sum_{\Phi_{i}\in M}\beta_{\Phi_{i}}\cdot z_{u}^{\Phi_{i}}.$ (5)

The comprehensive embeddings are the final representations of nodes learned by
SiamHAN, which aggregates multiple semantic characteristics. For instance, the
client node $s_{C}$ finally obtains the embedding with the semantics that
using specific browsers to access online services by integrating semantic-
specific embeddings $z_{C}^{\Phi_{FCF}}$ and $z_{C}^{\Phi_{SCS}}$.

Graph-level Attention. To gain the graph embedding for distance metric
learning, graph-level attention is proposed to aggregate the final embeddings
of all nodes in the knowledge graph. The importance of node $u$ could be
obtained as follow:

$\begin{gathered}g_{u}=q^{T}\cdot{\rm tanh}(W_{g}\cdot s_{u}+b_{g}),\\\
\gamma_{u}={\rm softmax_{u}}(g_{u})=\frac{{\rm exp}(g_{u})}{\sum_{u\in
V}(g_{u})},\end{gathered}$ (6)

where $W_{g}$ is the weight matrix, $b_{g}$ is the bias vector, and $q$ is the
graph-level attention parametrize matrix. Unlike $\alpha_{uv}^{\Phi}$ with
local attention on neighbors, a higher weight coefficient $\gamma_{u}$ denotes
globally matching similar nodes in the two knowledge graph. Therefore, the
graph embedding $Z$ could be formulated as follows:

$Z=\sum_{u\in V}\gamma_{u}\cdot s_{u}$ (7)

Metric Learning with Siamese Network. The goal of the siamese network
architecture in our work is to metric the distance $D$ between the knowledge
graph of two arbitrary IPv6 client addresses, which could be used to judge the
correlation relationship $R$ through a threshold $\eta$:

$\begin{gathered}D=||Z_{1}-Z_{2}||_{2},\\\ R=\left\\{\begin{aligned}
1&&D<\eta\\\ 0&&D\geq\eta\\\ \end{aligned}\right.,\end{gathered}$ (8)

where $Z_{1}$ and $Z_{2}$ are the final graph embeddings of the two input
knowledge graphs. $R=1$ means the two client addresses come from the same
user, otherwise $R=0$.

To train the attack model for IPv6 address correlation, SiamHAN requires sets
of positive samples and negative samples to learn the correlation function.
The positive samples are the pairwise knowledge graphs of IPv6 client
addresses bound to the same user. The negative samples are arbitrary pairs of
knowledge graphs that come from two different IPv6 users. With both negative
and positive samples in hand, SiamHAN could then be optimized by minimizing
the contrastive loss $L$:

$L=Y\cdot D^{2}+(1-Y)\\{{\rm max}(0,m-D)\\}^{2},$ (9)

where $Y$ are the labels of the input samples, and margin $m$ is a
hyperparameter to control the maximum distance that can be considered to
update the network. Furthermore, the network parameters are shared in the
pairwise network architecture, which focuses on the input difference and
learns the similarity.

##  5 Experimental Setting and Implementation

This section discusses our data collection and compared baselines, evaluation
metrics, and the model implementation.

###  5.1 Data Collection

To collect an extensive user dataset for attack experiments, we passively
monitored the IPv6 user traffic from March to July 2018 on China Science and
Technology Network (CSTNET). We intend to utilize persistent HTTP plaintext
cookies to label the TLS traffic of the addresses that leak these cookies.
This situation comes from that these users accessed some websites with HTTPS
deployment and used the same address to access some other websites without
HTTPS deployment during our traffic monitoring. Therefore, we mainly collected
5-month HTTP and TLS traffic to build the ground truth dataset. Firstly, we
searched persistent cookies used continuously during the monitor period
through the Cookie field in the HTTP plaintext to label the frequently
transforming client addresses, which obtains considerable address lists
corresponding to unique cookies. Note that we only record the persistent
cookies generated on the first day and continuously used during the
observation. We do not consider new cookies that appear during the monitoring
period to prevent biases from the accuracy of user labeling. Secondly, since a
user usually generates multiple cookies, we aggregate the lists with the same
addresses to acquire unique IPv6 HTTP users and their client addresses.
Finally, we searched for the communication records of these addresses in the
TLS traffic, thus obtaining encrypted communication data of 1.7k users and
2.6k addresses generated by them. Since SiamHAN requires pairwise client
address knowledge graphs as input, we combine any two addresses into pairs and
generate the correlation labels of the pair samples according to their user
labels, which results in 1.4M pair samples. The correlation label is 1 when
the two addresses belong to the same user. Otherwise, the correlation label is
0.

Table 3: The analysis of the 5-month real-world user dataset with 4 dimensions including the top ASes of client addresses, the top OSes of user devices, the top SNI accessed by users, and the prevalence of the TLS fields used in the paper. The prevalence of Record version and Cipher suites are shown as the percent of the field in ClientHello/ ServerHello. AS Name | %Hits | Device OS | %Hits | SNI | %Hits | TLS Field | %Hits
---|---|---|---|---|---|---|---
CSTNET | 78.6% | Windows | 63.7% | *.google.com | 17.9% | Record version | 93.1%/ 93.9%
China Unicom | 10.1% | Android | 23.7% | *.adobe.com | 11.6% | Client version | 93.1%
CNGI-CERNET2 | 4.0% | iOS | 6.2% | *.microsoft.com | 11.2% | Server version | 93.9%
CERNET | 2.4% | Linux | 5.0% | *.gstatic.com | 4.8% | Cipher suites | 93.1%/ 93.9%
Reliance Jio | 1.6% | Mac OS X | 1.3% | *.macromedia.com | 3.3% | Compression | 93.1%
Cloudflare | 0.8% | BlackBerry | 0.1% | *.cloudflare.com | 2.4% | SNI | 93.1%
PKU6-CERNET2 | 0.5% | Chrome OS | 0.1% | *.2mdn.net | 1.9% | Algorithm ID | 78.4%
TSINGHUA6 | 0.5% | Symbian OS | 0.1% | *.xboxlive.com | 1.6% | Issuer | 78.4%
ZSU6-CERNET | 0.4% | Firefox OS | 0.1% | *.xhcdn.com | 1.2% | Subject | 78.4%
Table 4: The average number of meta-infomation per knowledge graph with a 1-month background knowledge and the statistics of the dataset with a time-based split evaluated in the main experiments of the paper. Meta-Path $\Phi$ | Relations (A-B) | Number of A | Number of B | Entity | Training | Validation | Test
---|---|---|---|---|---|---|---
$SCS$ | Client-Server | 1.0 | 5.4 | User | 10.1k | 3.3k | 3.6k
$FCF$ | Client-Fingerprints | 1.0 | 3.8 | Sample Pair | 1.2M | 0.1M | 0.1M
$FSF$ | Server-Fingerprints | 5.4 | 41.3 | Knowledge | 3 months | 1 month | 1 month

###  5.2 Collection Ethics

To protect user privacy from being exposed in our attack experiments, we
anonymize all addresses collected in our dataset with 2001:db8::/32
documentation reserved prefix according to RFC 3849 [rfc3849]. All the
plaintext cookies for user labeling are encrypted due to our anonymization
work. During the traffic monitoring period, we did not over-explore data
involving personal information based on the Internet measurement standard. We
design a detailed exit mechanism to remove user traffic and only record
necessary traffic characteristics used in our experiments. Therefore, our
attack experiments are performed to correlate the users with virtualized user
IDs rather than linking to real-world individuals. We further guarantee that
our measurements do not disrupt or harm evaluation targets. Our work has been
approved by our institutional ethics review body to ensure ethical soundness
and justification.

###  5.3 Dataset

We evaluate SiamHAN on the real-world dataset collected through 5 months of
traffic monitoring. To indicate the practicality of the attack, we provide a
deep eye on the dataset composition and discuss the feasibility of the
experiment.

Basic Composition. After a long-time of data collection, we analyze the basic
dataset composition in Table 3. Results show that the dataset keeps a good
variation to evaluate the attack model. (1) User Source. We first analyze the
top ASes and the percent of addresses within each. During the observation, in
addition to the main source of CSTNET, the collected users come from diverse
IPv6 networks, including mobile networks (e.g., China Unicom), CDN networks
(e.g., Cloudflare), and university networks (e.g., PKU6-CERNET2). (2) Client
Device. Since the users are labeled by the HTTP plaintext in our dataset, we
additionally analyze their HTTP user-agent to infer their device OSes. Results
indicate that IPv6 users are using multiple types of devices during the
monitoring. (3) Online Habits. Considering the top SNI accessed by users,
although the top 3 domains obtain most visitors, the not high percent of each
indicates that IPv6 users keep extensive online habits and complex behavior in
our dataset.

Graph Samples. To better understand the composition of the meta-information in
a knowledge graph, we show the statistics of the knowledge graph built for
each client address with 1-month background knowledge in Table 4. Since most
client addresses are short-lived due to IPv6 address transform, each client
address is used to access an average of 5 $\sim$ 6 online services during the
1-month observation. In addition, considering the observation bias caused by
issues like packet loss, a few TLS connections do not contain ClientHello,
ServerHello, or Certificate message, which lead to an average of 3.8 client
fingerprint nodes and 41.3 server fingerprint nodes in each knowledge graph.
To simulate a realistic setting implemented by an adversary, we evaluate
SiamHAN in the main experiments of the paper with a time-based split on the
5-month dataset, which uses the first 3-month data for training, the 4th
month’s data for validation, and the 5th month’s data for test. Note that the
test user is excluded from the training set. The adversary’s intention is to
train the attack model on the history dataset and perform the attack on the
future collected dataset with the background knowledge.

Feasibility Discussion. There may remain doubts about the dataset that could
be discussed: (1) Label Trick. Since the leaked plaintext cookies are
available to label the TLS users in our dataset, one of the doubts could be
the necessity of the adversary to train SiamHAN. According to the statistics,
we collect a total of 0.58M addresses in the 5-month TLS traffic. Users of
only 2.9k addresses expose their HTTP cookies (including the newly generated
cookies during the observation), which is a ratio of 0.5%. Therefore, most TLS
users never reveal their plaintext cookies, which shows a strong motivation to
perform the attack. (2) User Assumption. Our dataset is all composed of users
with plaintext cookies. Therefore, another doubt is whether the assumption
that users without any plaintext cookies would behave the same as users with
plaintext cookies is reasonable. To address the issue, we additionally provide
an analysis of users without plaintext cookies in Appendix A. The similar user
source and online habits indicate that the model trained on the users with
plaintext cookies could be directly generalized to perform effective attacks
on the TLS users without plaintext cookies. (3) Feature Prevalence. In Table
3, we analyze the prevalence of the TLS fields used in the paper. The frequent
appearance of most fields in the TLS connections ensures that the fingerprints
are sufficient to perform the attack. Although more knowledge graphs may lack
the fingerprints related to the Certificate message, the knowledge volume
composed of other features is still enough to perform the strong correlation
attack.

###  5.4 Baselines

The prior work mainly performs user correlation under TLS traffic from the
dimensions including user profiling [GonzalezSL16, KumpostM09], TLS
fingerprinting [AndersonM17], and flow sequences [NasrBH18]. Among them, we
implement four representative methods to compare with SiamHAN: (1) User IP
Profiling [GonzalezSL16]. User IP Profiling is building user profiles through
all the destination IPs of the client address and using a Bayesian classifier
[0021593] to identify known users in a closed-word dataset. To apply address
correlation to identify unknown users in an open-world scenario, we use
pairwise profiles as input to the classifier to evaluate the performance of
correlation attacks. (2) User SNI Profiling [KumpostM09]. User SNI Profiling
is to use the SNIs in all the TLS ClientHello messages from the client as a
user interest identification. Similar to Banse et al. [HerrmannBF13], we also
exploit a Bayesian classifier to input pairwise SNI profiles to correlate user
activities. (3) Client Fingerprinting [AndersonM17]. Client Fingerprinting is
to extract the specific fields of the TLS ClientHello message as the user’s
client fingerprints and leverages Random Forest [Breiman01] to learn the
correlation of any two paired fingerprints. (4) Deepcorr [NasrBH18]. Deepcorr
uses the flow sequence characteristics to achieve correlation tasks in
multiple scenarios [WangR03, NasrBH18, BahramaliHSGT20]. To keep the same
setup with Deepcorr, we also extract a flow sequence of 300 packets per client
address to indicate the performance of Deepcorr.

###  5.5 Evaluation Metrics

Our evaluation metrics include true positive rate, false-positive rate, area
under ROC curve, and accuracy: (1) True Positive Rate (TPR). The TPR measures
the fraction of associated address pairs that are correctly declared to be
correlated by SiamHAN. (2) False Positive Rate (FPR). The FPR measures the
fraction of non-associated address pairs that are mistakenly identified as
correlated by SiamHAN. (3) Area Under Curve (AUC). The AUC metric is to
calculate the area under the ROC curve formed by TPRs and FPRs with multiple
thresholds, which is frequently used in binary classification tasks. (4)
Accuracy. To evaluate the user tracking and user discovery tasks applied by
correlation attacks, we define two task-based accuracy metrics to indicate the
attack performance. In the user tracking task, the Tracking Accuracy (TA) is
used to measure the fraction of correctly identified address pairs associated
or non-associated with the target user samples. While in the user discovery
task, the Discovery Accuracy (DA) is used to evaluate the fraction of
addresses that are correctly classified into unique user groups.

###  5.6 Implementation

During the data preprocessing, we limit the maximum node number to 50 and the
maximum node attribute length to 50 in each knowledge graph. As such, the
dimension of the adjacency matrix $A$ and the feature matrix $X$ is
50$\times$50\. The matrix contains padding or truncating operations due to the
difference between the number of each graph’s nodes or the attribute length of
each node. The character in node attributes is encoded to digital and the
feature matrix $X$ finally requires row-normalization as the input of SiamHAN.
When training SiamHAN, we randomly initialize parameters and optimize the
model with Adam [KingmaB14]. We set the learning rate to 0.005, the
regularization parameter to 0.001, and the dimension of the hierarchical
attention parametrize matrix $a$, $p$, $q$ to 100, 128, 128. Besides, we also
set the number of attention head K to 4. The activation function $\sigma$ is
LeakyReLU. The margin $m$ is 20, and the threshold $\eta$ for address
correlation is 10. We use early stopping with a patience of 100 to train the
model.

##  6 Evaluation

This section presents the analysis of IPv6 address transform scenarios and all
experimental results showing the effectiveness of correlation attacks
conducted by SiamHAN.

###  6.1 Analysis of Address Transform

During the 5-month traffic monitor, IPv6 users frequently updated their client
addresses for communication. Figure 4 reveals the average transform time of
these client addresses. 80% of IPv6 users change their client addresses at
least once a month, which shows the universality of address transform in IPv6
networks. Considerable users frequently change the client address within two
weeks. Since RFC 4941 [rfc4941] recommends the lifetime of the temporary
address is one day to one week, the appearance in the TLS traffic is
consistent with the instruction. Furthermore, we also analyze the addressing
scheme of the address dataset. 98% of changing user’s addresses update the
subnet identifier, which explains the mobility of users because the Regional
Internet Registry (RIR) usually sets this identifier for different regions. In
addition, 23% of user’s addresses maintain a constant IID, while 77% of IPv6
users use a stable or temporary IID. The analysis results demonstrate that the
transform of IPv6 client addresses leads to difficulty in conducting effective
user correlation under TLS encrypted traffic.

Figure 4: The number of users and their addresses with different average
change time under the 5-month TLS traffic.

###  6.2 Analysis of Hierarchical Attention

To implement IPv6 client address correlation attacks, a salient property of
SiamHAN is the incorporation of the hierarchical mechanism, which takes the
importance of similar meta-information from two client addresses to help
distance metric. Figure 5 shows a case of two addresses’ knowledge graphs and
the hierarchical attention on partial nodes. In this setting, the two client
nodes $C$ 111The node attributes of client node $C$ are
2001:db8:3999::d05b:e903:1e77 and 2001:db8:880b::d05b:e903:1e77 in the two
knowledge graphs. link to 2 and 4 server nodes $S$ respectively, where $S_{2}$
is the common destination address. $F_{1}\sim F_{4}$ 222The corresponding
feature of each node label is shown in Table 2. are the client fingerprint
nodes link to $C$ and $F_{5}\sim F_{13}$ are the server fingerprint nodes link
to $S_{2}$.

(a) $SCS$ attention of node $C$

(b) $FCF$ attention of node $C$

(c) $FSF$ attention of node $S_{2}$

(d) Semantic attention

(e) Graph attention on partial nodes $C\sim F_{13}$

Figure 5: A case study of hierarchical attention to help learn the similarity
between two addresses’ meta-information.

Analysis of Node-level Attention. Node-level attention focuses on significant
similar meta-information in each meta-path-based neighbor between two graphs,
which is a local view on each node to learn the semantic-specific embeddings.
For instance, the $SCS$ meta-path-based neighbor attention of node $C$ is
shown in Figure 5(a). The high attention values of node $C$ and $S_{2}$ come
from the constant IID in the address of $C$ and the common server address of
$S_{2}$ between the two input graphs. In addition, among the $FCF$ meta-path
based neighbors in Figure 5(b), $F_{3}$ reaches a high attention value except
for $C$ due to the same cipher suits used. The other client fingerprint nodes
obtain low attention because they are usually the same regardless of the
correlated or not correlated addresses, which lacks distinction to learn the
unique embedding for the correlation task. Finally, as an example of $FSF$
node-level attention shown in Figure 5(c), $F_{5},F_{10},F_{11},F_{13}$
correspond to the server fingerprints including SNI, issuer, subject, and flow
count, respectively, which indicate they are more important to contribute to
the server service embeddings learning.

Analysis of Semantic-level Attention. Semantic-level attention aggregates the
3-type semantic-specific embeddings for each node through the importance
weights, which denotes the importance of meta-paths for the correlation task.
In Figure 5(d), the $FCF$ meta-path reaches the most attention in both the two
knowledge graphs. The result indicates that the semantic-specific embedding
learned by user browser parameters substantially affects the user correlation.

Analysis of Graph-level Attention. Graph-level attention provides a global
view on the similar final embedding of all nodes in the two graphs. The
weights of partial nodes $C\sim F_{13}$ are shown in Figure 5(e). Among them,
client node $C$ and client fingerprint nodes $F_{1}\sim F_{4}$ obtain higher
attention values than the server-related nodes. It indicates SiamHAN takes
more attention to the strong correlation from the client meta-information
while only keeping eyes on specific server meta-information due to the
complexity of user activity. Finally, SiamHAN could effectively leverage the
meta-information integrated from address-based and traffic characteristic
correlation to perform correlation attacks.

Figure 6: The performance of all baselines compared to SiamHAN based on the
5-month time-based split dataset.

Figure 7: SiamHAN’s performance on different background knowledge volume
$\kappa_{t}$ formed by wiretapping times $t$.

###  6.3 Address Correlation

To explore the effectiveness of IPv6 address correlation attacks, we first
measure the correlation performance of arbitrary address pairs performed by
SiamHAN. In this experimental setting, an adversary could conduct correlation
attacks on arbitrary pairwise addresses based on the background knowledge
$\kappa_{t}$. By constructing training pair samples and test pair samples, we
comprehensively evaluate SiamHAN’s performance on pairwise addresses
correlation tasks.

Correlation Performance. As a first look at the correlation performance, we
train the attack model on the dataset with a time-based split setting. Figure
6 compares the ROC curve of SiamHAN to other systems on the dataset. As can be
seen, SiamHAN significantly outperforms the prior correlation algorithms with
a wide gap between the ROC curve of SiamHAN and other approaches. For
instance, for a target FPR = $2\times 10^{-2}$, while SiamHAN achieves a TPR
of 0.99, all baselines provide TPRs less than 0.40. The drastic improvement
comes from the fact that SiamHAN could model a correlation function tailored
to pairwise client addresses with moderate learning on the knowledge of
addresses. Since the test dataset contains addresses from not seen users in
the training set, SiamHAN keeps a strong practical ability to correlate
unknown addresses on the open-world dataset.

Adversary’s Background Knowledge. In an IPv6 address correlation attack, the
adversary’s background knowledge $\kappa_{t}$ is essential to build the
knowledge graph for each intercepted address. In Figure 7, we measure the
impact of knowledge volume on SiamHAN’s performance with different wiretapping
times $t$. In this experiment, we set the same training and test addresses
with different knowledge durations to build their graph samples. Results
indicate that a less than 2-week wiretapping time can not perform a strong
enough correlation ability due to the weak knowledge volume. The adversary is
only required 1-month monitor to correlate arbitrary address pairs with 99%
accuracy effectively. The performance of 5-month knowledge is more
unsatisfactory than the 1-month knowledge when FPR is less than $2\times
10^{-2}$, which may be due to the complexity of user activity in a more
extended period.

Figure 8: SiamHAN’s performance is consistent regardless of the test size
under the 1-month background knowledge.

Robustness of Test Users. On the consideration of SiamHAN’s practicality, we
also show the correlation performance on the different sizes of the test
dataset. Figure 8 presents the ROC curve results on test datasets with
different numbers of sample pairs. The results are consistent for different
numbers of addresses being correlated. It suggests the robustness of SiamHAN
on the diverse user data. SiamHAN could provide stable correlation performance
even when applied on significantly larger datasets of intercepted addresses,
e.g., on the traffic collected by a large malicious IXP.

Timeliness. Since the traffic characteristics of IPv6 users change over time,
the deep learning-based algorithm requires timeliness evaluation to conduct a
long-term reliable performance. Figure 9 compares the results with different
time gaps between training and test. In this experimental setting, we train
SiamHAN on the dataset collected in the first month and test the pre-trained
model on the same 1-month background knowledge dataset after different time
gaps. The results indicate that SiamHAN’s performance does not degrade with
the long-time gap. For a target FPR = $10^{-1}$, under all time gaps, SiamHAN
provides TPRs more than 0.95, demonstrating that the continued effectiveness
of the IPv6 address correlation attack model.

Figure 9: SiamHAN’s performance on different time gaps between training and
test dataset for timeliness evaluation.

###  6.4 User Tracking

After obtaining the pre-trained attack model, the IPv6 address correlation
attack could be applied to long-term user correlation tasks. We introduce user
tracking, the first challenging task to sustainedly search target IPv6 users
under the large-scale TLS encrypted traffic.

Tracking Algorithm. Given a pre-trained SiamHAN, based on the background
knowledge, an adversary could conduct long-time user tracking by searching all
addresses correlated to the address sample of target users. For a determined
tracking candidate set $S$ that contains the one client address for each
target user, the adversary is required to combine each candidate $S_{i}$ with
each test address $T_{j}$ in the test dataset $T$ and build the pairs of their
knowledge graphs $\langle S_{i},\,T_{j}\rangle$ as SiamHAN’s inputs, where
$i\leq|S|$ and $j\leq|T|$. Appendix B shows the detail of the tracking
algorithm.

Tracking Performance. To implement IPv6 user tracking, we train SiamHAN and
all compared baselines on the time-based split training set and select target
user addresses from the test users to measure the tracking performance on the
test dataset. Figure 10 indicates the tracking performance of all baselines
and SiamHAN in the user tracking task. As can be seen, SiamHAN could correctly
identify 1.17$\sim$1.32 times more address pairs associated or non-associated
with the target user samples than the state-of-the-art correlation system
Deepcorr. SiamHAN outperforms existing correlation techniques with 99%
accuracy compared to Deepcorr’s 82% accuracy on the user tracking task.

###  6.5 User Discovery

User discovery is the second challenging task applied by SiamHAN, which could
obtain the address groups to discover unique IPv6 users on the large-scale
encrypted traffic.

Figure 10: The tracking performance of all baselines compared to SIamHAN on
the 5-month time-based split dataset with different sizes of tracking
candidate $|S|$.

Discovery Algorithm. Based on the adversary’s background knowledge, the
adversary could construct the knowledge graph for each intercepted address and
use a recursion algorithm to determine the unique users. The algorithm first
selects an arbitrary address as the first user group. Then, in each iteration,
the identified user group set is $G$, the algorithm calculates the average
distance $\bar{D_{i}}$ between the new input address and each identified user
group $G_{i}$’s addresses, where $i\leq|G|$. When all $\bar{D_{i}}>\eta$, we
build a new user group $G_{|G|+1}$ for the current input address, while if
some $\bar{D_{i}}\leq\eta$, we classify the input address into the user group
with the closest distance. Appendix C shows the detail of the discovery
algorithm.

Discovery Performance. In our experiments, to explore the performance of user
discovery on the real-world 5-month dataset, we also train and test the model
on the dataset with the time-based split setting. Figure 11 indicates the
discovery performance of all baselines and SIamHAN in the user discovery task.
Results show a massive gap between SiamHAN and previous correlation
approaches. For instance, SiamHAN provides a discovery accuracy of 88%
compared to 59% by the state-of-the-art system Deepcorr using the same
setting, which comes from SiamHAN’s $1.45\sim 1.60$ times more hit than
Deepcorr. The significantly high accuracy of SiamHAN ensures the practicality
to discover active IPv6 users in the wild traffic.

###  6.6 Ablation Study

In addition to showing the experiments on the specific tasks, we present the
ablation study experiments by evaluating the variants of SiamHAN to indicate
the model superiority sufficiently. Table 5 shows all results of the ablation
study.

Embedding Learning with Other GNNs. We further investigate whether our attacks
are applicable to other GNNs with siamese networks. Concretely, we focus on
GraphSAGE [HamiltonYL17] and GAT [VelickovicCCRLB18], which are also well-
known for inductive learning like HAN. We implement Siamese GraphSAGE and
Siamese GAT by replacing the heterogeneous graph attention component in
SiamHAN. Results show GNNs’ powerful performance to learn the final graph
embedding for general IPv6 address correlation. The variants with other GNNs
still outperform previous correlation systems in all three evaluation tasks.
However, SiamHAN keeps an unreachable better attack performance than other
GNNs due to the semantic learning from the communication in heterogeneous
graphs.

Effectiveness of Different Fingerprint Types. Since we collect client and
server fingerprints as the meta-information for traffic characteristic
correlation, to observe the importance of the two types of fingerprints, we
implement SiamHAN \- Client and SiamHAN \- Server for the fingerprints
ablation study. The two variants respectively remove all client fingerprint
nodes or all server fingerprint nodes when building the knowledge graphs. In
the experimental results, SiamHAN \- Client’s performance is poorer than
SiamHAN \- Server. It indicates that client fingerprints contribute more to
the correlation attack due to the more performance decrease when SiamHAN lacks
client fingerprints.

Figure 11: The discovery performance of all baselines compared to SIamHAN on the 5-month time-based split dataset with the different number of test users (discovery candidate). Table 5: Ablation study on the 5-month time-based split dataset with all 3 experimental tasks. Model |  | Address Correlation |  | User Tracking |  | User Discovery
---|---|---|---|---|---|---
| AUC | Accuracy |  | AUC | Tracking Accuracy |  | Discovery Accuracy
Siamese GraphSAGE |  | 0.975 | 0.964 |  | 0.972 | 0.943 |  | 0.849
Siamese GAT |  | 0.990 | 0.985 |  | 0.985 | 0.958 |  | 0.870
SiamHAN \- Client |  | 0.989 | 0.976 |  | 0.982 | 0.955 |  | 0.851
SiamHAN \- Server |  | 0.991 | 0.986 |  | 0.983 | 0.960 |  | 0.875
SiamHAN \- Node |  | 0.831 | 0.756 |  | 0.875 | 0.885 |  | 0.653
SiamHAN \- Semantic |  | 0.988 | 0.972 |  | 0.988 | 0.949 |  | 0.855
SiamHAN \- Graph |  | 0.986 | 0.954 |  | 0.987 | 0.932 |  | 0.836
SiamHAN \- Classifier |  | 0.922 | 0.890 |  | 0.913 | 0.890 |  | 0.847
User IP Profiling |  | 0.868 | 0.754 |  | 0.622 | 0.653 |  | 0.513
User SNI Profiling |  | 0.825 | 0.685 |  | 0.515 | 0.463 |  | 0.534
Client Fingerprinting |  | 0.920 | 0.842 |  | 0.767 | 0.797 |  | 0.406
Deepcorr |  | 0.937 | 0.882 |  | 0.801 | 0.825 |  | 0.590
SiamHAN |  | 0.992 | 0.990 |  | 0.993 | 0.996 |  | 0.885

Effectiveness of Different Level Attentions. To explore the effectiveness of
each level of attention in the hierarchical attention, we also present three
attention variants including SiamHAN \- Node, SiamHAN \- Semantic, and SiamHAN
\- Graph. The three variants respectively remove node-level, semantic-level,
or graph-level attention and assign the same importance to each neighbor, each
meta-path, or each final node embedding in the graph. Compared to SiamHAN, the
performance of SiamHAN \- Node drastically degrades, which indicates that
attention on each node’s neighbors is essential for the correlation task.
Among the three types of attention, semantic-level attention contributes the
least. Every level of attention could provide effective improvement to finally
lead to the significantly high accuracy of SiamHAN.

Effectiveness of Distance Metric. To indicate the superiority of the distance
function learned for correlation, we replace SiamHAN’s distance learning with
a binary classifier to build the variant SiamHAN \- Classifier. Results
indicate that SiamHAN \- Classifier’s performance still keeps a great margin
compared to SiamHAN. Since distance learning provides a more precise
description of the difference between the two knowledge graphs, the distance
metric architecture outperforms the classifier on the correlation task.

###  6.7 Time Complexity

For the user tracking task, the attack generally tracks only a limited number
of target users in the network. Thus the time complexity is $O(cN)$, where $c$
is the number of target users. For the user discovery task, the discovery
algorithm could be simplified by only computing the correlation relationship
between the test address and one of the clustered addresses in each iteration.
Therefore, the time complexity is $O(kN)$, where $k$ is the number of the
cluster category. It is the usual time complexity of most cluster algorithms
like K-means.

##  7 Countermeasures

To fight against IPv6 address correlation attacks, we discuss two possible
countermeasures: traffic obfuscation and the mechanisms to reduce the
adversary’s attack chances.

###  7.1 Traffic Obfuscation

An intuitive countermeasure against IPv6 address correlation attacks is to
obfuscate TLS traffic used by SiamHAN. We show four types of traffic
obfuscation methods in Table 6. C-Random and CF-Random respectively denote
using random forged addresses or browser parameters to obtain random client
nodes or combinations of random client fingerprint nodes. CF-Background and
SF-Background are the methods of adding background traffic with different
browsers or different online services. The background traffic volume is the
same as the original traffic of each user. Results indicate that each single
obfuscation method is not effective enough to defend against SiamHAN since the
correlation attack focuses on multi-type meta-information to find the
similarity. When given a combination to apply all four methods, SiamHAN’s
accuracy significantly degrades due to the knowledge barrier, which indicates
that defending against IPv6 address correlation attacks requires strict
restriction for address-based and traffic characteristic correlation.

Table 6: SiamHAN’s accuracy with traffic obfuscation methods on the 5-month dataset with the time-based split. Obfuscation | Address | User | User
---|---|---|---
Method | Correlation | Tracking | Discovery
C-Random | 0.893 | 0.921 | 0.798
CF-Random | 0.906 | 0.916 | 0.805
CF-Background | 0.929 | 0.935 | 0.814
SF-Background | 0.936 | 0.926 | 0.827
Combination | 0.742 | 0.725 | 0.609

###  7.2 Attack Chance Reduction

Another countermeasure against IPv6 address correlation attacks is reducing an
adversary’s attack chances: (1) Since the adversary requires a long-term
monitor to form the background knowledge, IPv6 users could escape the
measurement on malicious IXPs by using proxies or Tor system. (2) To protect
the meta-information exposed in the TLS handshake, applications like encrypted
VPN could fundamentally render the attack impracticable. (3) We argue that
designing address-user relation protection techniques like NAT are a promising
avenue to defend against IPv6 address correlation attacks.

##  8 Conclusion

In this work, we explore the implementation of user activity correlation on
IPv6 networks. We propose IPv6 address correlation attacks, which leverages an
attack model SiamHAN to learn the correlation relationship between two
arbitrary IPv6 addresses based on the background knowledge of TLS traffic.
Through multi-level attention and metric learning on pairwise heterogeneous
knowledge graphs, SiamHAN could perform strong address correlation even on the
long-term correlation tasks, including user tracking and user discovery.
Numerous experiments indicate that SiamHAN’s powerful performance and
practicality to outperform state-of-the-art algorithms by significant margins.
We exploit effective countermeasures and publish the source code of SiamHAN
and the dataset to help future research on IPv6 address correlation attacks.

## Appendix

##  Appendix A A Analysis of Users without Plaintext Cookies

The analysis of TLS users without plaintext cookies is shown in Table 7.

Table 7: The analysis of TLS users without plaintext cookies with 2 dimension including the top ASes of client addresses and the top SNI accessed by users. AS Name | %Hits | SNI | %Hits
---|---|---|---
CSTNET | 75.2% | *.google.com | 18.3%
China Unicom | 10.3% | *.adobe.com | 14.6%
CNGI-CERNET2 | 5.1% | *.microsoft.com | 13.2%
CERNET | 3.0% | *.facebook.com | 7.8%
Reliance Jio | 1.3% | *.cloudflare.com | 4.3%
TSINGHUA6 | 0.7% | *.icloud.com | 4.0%
Cloudflare | 0.6% | *.exoclick.com | 2.8%
PKU6-CERNET2 | 0.5% | *.macromedia.com | 2.3%
ZZU6-CERNET2 | 0.5% | *.flurry.com | 1.4%

##  Appendix B B Tracking Algorithm

The detailed tracking algorithm is shown in Algorithm 1.

Algorithm 1 The tracking algorithm applied by SiamHAN

0: Pre-trained SiamHAN $\rho$; Tracking candidate set $S$; Test address set
$T$; Background knowledge $\kappa_{t}$.

0: Address sets $T_{S_{i}}$ link to the same user with each $S_{i}$

1: for $S_{i}$ in tracking candidate set $S$, where $i\leq|S|$ do

2: Initialize target address set $T_{S_{i}}=\\{\\}$

3: for $T_{j}$ in test address set $T$, where $j\leq|T|$ do

4: Build pairwise knowledge graphs for $\langle S_{i},\,T_{j}\rangle$

5: Test relationship $R$ of $\langle S_{i},\,T_{j}\rangle$ using pre-trained
$\rho$

6: end for

7: Append $T_{j}$ in address set $T_{S_{i}}$ if relationship $R=1$

8: end for

9: return $T_{S_{i}}$ for each $S_{i}$

##  Appendix C C Discovery Algorithm

The detailed discovery algorithm is shown in Algorithm 2.

Algorithm 2 The discovery algorithm applied by SiamHAN

0: Pre-trained SiamHAN $\rho$; Discovery candidate set $S$; Background
knowledge $\kappa_{t}$; Task threshold $\eta$.

0: User groups $G$ under the discovery candidate set $S$

1: Build knowledge graphs for each $S_{i}$

2: Initialize user group set $G=\\{G_{1}\\}$

3: Initialize $S_{1}$ into the first user group $G_{1}$

4: for $S_{i}$ in discovery candidate set $S$, where $1<i\leq|S|$ do

5: for $G_{k}$ in user group set $G$ do

6: for Address $S_{j}$ in group $G_{k}$, where $j\leq|G_{k}|$ do

7: Calculate distance $D$ for $\langle S_{i},\,S_{j}\rangle$ using $\rho$

8: end for

9: Calculate average distance $\bar{D_{k}}$ for $S_{i}$ to $G_{k}$

10: end for

11: if All group average distance $\bar{D_{k}}>\eta$ then

12: Initialize a new user group $G_{|G|+1}$ into $G$

13: Initialize $S_{i}$ into the new user group $G_{|G|+1}$

14: else

15: Classify $S_{i}$ into $G_{k}$ with the minimum $\bar{D_{k}}$

16: end if

17: end for

18: return User group set $G$