Ephemeral Network-Layer Fingerprinting Defenses#

Authors: Tobias Pulls (Karlstad University), Topi Korhonen (Independent), Ethan Witwer (Linköping University), Niklas Carlsson (Linköping University)

• Why: Passive network-layer fingerprinting (TCP/IP stack and header-level characteristics, p0f-style) is how censors and adversaries identify proxies, bridges, and tunnel traffic without decrypting anything. Pulls is a long-time traffic-analysis researcher, and this sits squarely in network security operations: it's the same fingerprinting your anti-abuse or DLP stack might do — from the other side.
• What: Apparently defenses that make a host's network-layer fingerprint ephemeral — changing over time so long-lived passive classifiers can't match or block on stack characteristics (title/author line only — no abstract in program).
• How: Presumably systematic mutation of network-layer identifiers (header options, timing, fragmentation behavior) on a rotating basis, with evaluation against real classifiers.
• Where applicable: Circumvention/proxy infrastructure (Tor bridges, VPN endpoints) and any deployment that must survive passive, low-cost classification by a network observer. General technique at the OS/network-stack level.