Statistical Identification of Encrypted Web Browsing Traffic

Encryption is often proposed as a tool for protecting the privacy ofWorld Wide Web browsing.However, encryption–particularly astypically implemented in, or in concert with popular Webbrowsers–does not hide all information aboutthe encryptedplaintext.Specifically, HTTP object count and sizes are oftenrevealed (or at least incompletely concealed). We investigate theidentifiability of World Wide Web traffic based on this unconcealedinformation in a large sample of Web pages, and show that it sufficesto identify a significant fraction of them quite reliably.We alsosuggest some possible countermeasures against the exposure of thiskind of information and experimentally evaluate their effectiveness.