使用HTTPS加密连接访问网站可以防止监听。监听者顶多能知道你访问的网站IP地址，而不知道具体访问了哪个网页。但现在安全研究人员发表了一篇学术论文《I Know Why You Went to the Clinic: Risks and Realization of HTTPS Traffic Analysis》，称可以通过分析加密流量的差异，揭示出用户访问了哪个网页， 了解网页内容是否与妊娠、头痛、癌症或自杀等信息有关。他们的方法很简单，先访问HTTPS网站的某个特定URL地址，收集加密流量数据特征，然后根据特 征观察加密流量会话，判断用户访问了哪个地址。研究人员是根据高斯分布寻找加密流量之间的相似性。这项研究显示，加密数据并不意味着你的个人隐私能得到保 护。

I Know Why You Went to the Clinic: Risks and Realization of HTTPS Traffic Analysis

Revelations of large scale electronic surveillance and data mining by governments and corporations have fueled increased adoption of HTTPS. We present a traffic analysis attack against over 6000 webpages spanning the HTTPS deployments of 10 widely used, industry-leading websites in areas such as healthcare, finance, legal services and streaming video. Our attack identifies individual pages in the same website with 89% accuracy, exposing personal details including medical conditions, financial and legal affairs and sexual orientation. We examine evaluation methodology and reveal accuracy variations as large as 18% caused by assumptions affecting caching and cookies. We present a novel defense reducing attack accuracy to 27% with a 9% traffic increase, and demonstrate significantly increased effectiveness of prior defenses in our evaluation context, inclusive of enabled caching, user-specific cookies and pages within the same website.

http://arxiv.org/abs/1403.0297
http://arxiv.org/pdf/1403.0297.pdf

参考资料：http://www.solidot.org/story?sid=38623

转载请注明：jinglingshu的博客 » 加密流量分析揭示你是否怀孕或患重病