Defending against Traffic Analysis Attacks with Flexible In-Network Obfuscation#

Guorui Xie, Qing Li (Pengcheng Laboratory), Zhenning Shi (Tsinghua Shenzhen), Gianni Antichi (Politecnico di Milano), et al.

• Why: Encrypted-traffic side channels (packet sizes, timing) keep working through TLS 1.3 and QUIC; existing defenses trade too much bandwidth or need unrealistic coordination. This makes in-network defense cheap enough to consider.
• What: "Securitas," an obfuscation framework that cuts traffic-analysis attack accuracy by up to 95.89% while consuming 42.69x less bandwidth than prior defenses; real-Internet tests show ~0.15s added web page load.
• How: A learning-guided mix of packet fragmentation and insertion, chosen adaptively rather than via fixed padding rules; implemented across four data planes — Tofino switch, FPGA, eBPF, and BMv2 — which is unusual deployability evidence.
• Where applicable: Any operator that can insert obfuscation on-path (switch, NIC, or eBPF host). The multi-dataplane implementation means the defense isn't tied to one vendor's silicon; evaluation includes real-world Internet paths, not just lab topologies.