Marc Rennhard

Practical Anonymity for the Masses with MorphMix

MorphMix is a peer-to-peer circuit-based mix network to provide practical anonymous low-latency Internet access for millions of users. The basic ideas of MorphMix have been published before; this paper focuses on solving open problems and giving an analysis of the resistance to attacks and the performance it offers assuming realistic scenarios with very many users. We demonstrate that MorphMix scales very well and can support as many nodes as there are public IP addresses. In addition, we show that MorphMix is indeed practical because it provides good resistance from long-term profiling and offers acceptable performance despite the heterogeneity of the nodes and the fact that nodes can join or leave the system at any time.

Practical anonymity for the masses with mix-networks

Designing mix-networks for low-latency applications that offer acceptable performance and provide good resistance against attacks without introducing too much overhead is very difficult. Good performance and small overheads are vital to attract users and to be able to support many of them, because with only a few users, there is no anonymity at all. In this paper, we analyze how well different kinds of mix-networks are suited to provide practical anonymity for a very large number of users.

An architecture for an anonymity network

It is difficult to design a system that provides anonymity for delay-sensitive services such as Web browsing. Existing systems are either not resistant against sophisticated attacks or they achieve their level of anonymity at the cost of a high bandwidth overhead. In addition, these systems do not meet all of our requirements. In this paper, we present the architecture of our prototype implementation of an anonymity network. Our system is trustworthy, fair, stable, modular, and bases on the well studied and accepted secure sockets layer protocol. With this system, we want to derive quantitative results about the tradeoff between anonymity and performance penalty. We will then extend our anonymity network such that it provides high resistance against various attacks while minimizing its bandwidth overhead.

Histogram Matrix: Log File Visualization for Anomaly Detection

In todays IT environments, there is an ever increasing demand for log file analysis solutions. Log files often contain important information about possible incidents, but inspecting the often large amounts of textual data is too time-consuming and tedious a task to perform manually. To address this issue, we propose a novel log file visualization technique called Histogram Matrix (HMAT). HMAT visualizes the content of a log file in order to enable a security administrator to efficiently spot anomalies. The system uses a combination of graphical and statistical techniques and allows even non-experts to interactively search for anomalous log messages. Contrary to other approaches, our proposal does not only work on certain special kinds of log files, but instead works on almost every textual log file. Additionally, the system allows to automatically generate security events if an anomaly is detected, similar to anomaly-based intrusion detection systems. This paper introduces HMAT, demonstrates its functionality using log files from a variety of services in real environments, and identifies strengths and limitations of the technique.