arXiv subjects

Marwan Fayed

Publications and source records attributed to Marwan Fayed.

4 recordsLinked to original sources

arXiv2022

You get PADDING, everybody gets PADDING! You get privacy? Evaluating practical QUIC website fingerprinting protections for the masses

Website fingerprinting (WF) is a well-know threat to users' web privacy. New internet standards, such as QUIC, include padding to support defenses against WF. Previous work only analyzes the effectiveness of defenses when users are behind a VPN. Yet, this is not how most users browse the Internet. In this paper, we provide a comprehensive evaluation of QUIC-padding-based defenses against WF when users directly browse the web. We confirm previous claims that network-layer padding cannot provide good protection against powerful adversaries capable of observing all traffic traces. We further demonstrate that such padding is ineffective even against adversaries with constraints on traffic visibility and processing power. At the application layer, we show that defenses need to be deployed by both first and third parties, and that they can only thwart traffic analysis in limited situations. We identify challenges to deploy effective WF defenses and provide recommendations to address them.

cs.CR↗

arXiv2020

Oblivious DNS over HTTPS (ODoH): A Practical Privacy Enhancement to DNS

The Domain Name System (DNS) is the foundation of a human-usable Internet, responding to client queries for host-names with corresponding IP addresses and records. Traditional DNS is also unencrypted, and leaks user information to network operators. Recent efforts to secure DNS using DNS over TLS (DoT) and DNS over HTTPS (DoH) have been gaining traction, ostensibly protecting traffic and hiding content from on-lookers. However, one of the criticisms of DoT and DoH is brought to bear by the small number of large-scale deployments (e.g., Comcast, Google, Cloudflare): DNS resolvers can associate query contents with client identities in the form of IP addresses. Oblivious DNS over HTTPS(ODoH) safeguards against this problem. In this paper we ask what it would take to make ODoH practical? We describe ODoH, a practical DNS protocol aimed at resolving this issue by both protecting the client's content and identity. We implement and deploy the protocol, and perform measurements to show that ODoH has comparable performance to protocols like DoH and DoT which are gaining widespread adoption, while improving client privacy, making ODoH a practical privacy enhancing replacement for the usage of DNS.

cs.CR↗

arXiv2019

Quality of Experience from Cache Hierarchies: Keep your low-bitrate close, and high-bitrate closer

Recent studies into streaming media delivery suggest that performance gains from cache hierarchies such as Information-Centric Networks (ICNs) may be negated by Dynamic Adaptive Streaming (DAS), the de facto method for retrieving multimedia content. The bitrate adaptation mechanisms that drive video streaming clash with caching hierarchies in ways that affect users' Quality of Experience (QoE). Cache performance also diminishes as consumers dynamically select content encoded at different bitrates. In this paper we use the evidence to draw a novel insight: in a cache hierarchy for adaptive streaming content, bitrates should be prioritized over or alongside popularity and hit rates. We build on this insight to propose RippleCache as a family of cache placement schemes that safeguard high-bitrate content at the edge and push low-bitrate content into the network core. Doing so reduces contention of cache resources, as well as congestion in the network. To validate RippleCache claims we construct two separate implementations. We design RippleClassic as a benchmark solution that optimizes content placement by maximizing a measure for cache hierarchies shown to have high correlation with QoE. In addition, our lighter-weight RippleFinder is then re-designed with distributed execution for application in large-scale systems. RippleCache performance gains are reinforced by evaluations in NS-3 against state-of-the-art baseline approaches, using standard measures of QoE as defined by the DASH Industry Forum. Measurements show that RippleClassic and RippleFinder deliver content that suffers less oscillation and rebuffering, as well as the highest levels of video quality, indicating overall improvements to QoE.

cs.NI↗

arXiv2016

RemIX: A Distributed Internet Exchange for Remote and Rural Networks

The concept of the IXP, an Ethernet fabric central to the structure of the global Internet, is largely absent from the development of community-driven collaborative network infrastructure. The reasons for this are two-fold. IXPs exist in central, typically urban, environments where strong network infrastructure ensures high levels of connectivity. Between rural and remote regions, where networks are separated by distance and terrain, no such infrastructure exists. In this paper we present RemIX a distributed IXPs architecture designed for the community network environment. We examine this praxis using an implementation in Scotland, with suggestions for future development and research.

cs.NI↗