To understand the needs of network researchers in an anonymization tool, we conducted a survey on the network researchers. We invited network researchers world-wide to the survey by sending invitation emails to well-known mailing lists whose subscribers may be interested in network research with collecting, sharing and sanitizing network traces

Kotz, David

Tan, Keren

Yeo, Jihwang

English

Dartmouth Digital Commons (Dartmouth College)

Dartmouth College Dartmouth Digital Commons Computer Science Technical Reports Computer Science 11-23-2009 User survey regarding the needs of network researchers in trace-anonymization tools Jihwang Yeo Dartmouth College Keren Tan Dartmouth College David Kotz Dartmouth College Follow this and additional works at: https://digitalcommons.dartmouth.edu/cs_tr  Part of the Computer Sciences Commons Dartmouth Digital Commons Citation Yeo, Jihwang; Tan, Keren; and Kotz, David, "User survey regarding the needs of network researchers in trace-anonymization tools" (2009). Computer Science Technical Report TR2009-658. https://digitalcommons.dartmouth.edu/cs_tr/331 This Technical Report is brought to you for free and open access by the Computer Science at Dartmouth Digital Commons. It has been accepted for inclusion in Computer Science Technical Reports by an authorized administrator of Dartmouth Digital Commons. For more information, please contact dartmouthdigitalcommons@groups.dartmouth.edu. User survey regarding the needs of network researchers intrace-anonymization toolsJihwang Yeo, Keren Tan, David KotzDartmouth Computer Science Technical Report TR2009-658November 23, 2009AbstractTo understand the needs of network researchers in an anonymization tool, we conducted a surveyon the network researchers. We invited network researchers world-wide to the survey by sending invi-tation emails to well-known mailing lists whose subscribers may be interested in network research withcollecting, sharing and sanitizing network traces.1 Survey set-upNetwork traces, which record the activity of network users, are an important tool in computer networkingresearch. It remains a difficult challenge to capture such traces, primarily because it is difficult to obtainpermission from the network operator. It is even more difficult to share network traces with others, becauseof privacy concerns.We hope increase network-trace sharing by making it safer and easier to “sanitize” network traces,that is, to remove sensitive identifiable information. Sanitization always involves a challenging trade-off between sanitization effectiveness (providing anonymity for network users and secrecy for networkoperational information) and research usefulness (since only the information retained can be used by theresearcher).We set out to survey network researchers to determine what experience they had with collecting, san-itizing, or using network traces. We asked about 30 questions regarding collecting, sharing and sanitizingnetwork traces, using sanitization tools, and evaluating sanitization results. The survey takes 5-15 minutesbut the survey participant can stop earlier if he or she wishes. In the end, 108 people participated in thesurvey. We conducted our survey during the period from May 21, 2009 to October 27, 2009.2 Survey resultsAccording to their responses, 84% of the participants have collected network traces and 88% of the collectedtraces contain some sensitive information. More than 83% of the participants agree that protecting personalinformation is a major concern when sharing the traces with others and this issue is considered to be anobstacle. About 55% of the participants who have collected their own traces, have experience of sanitizingthe traces. Among them, only 39% used third-party tools while about 71% of people used their ownsoftware. Regarding the verification of sanitization result, 84% of 38 responders answered that they didnot use any quantitative metrics to measure the strength of the sanitization. Also, 76% of the respondersthought that the sanitization they applied will limit the usefulness of network traces. About half of 86participants have never heard or used any sanitization tools. The tools that participants reported to haveheard or used for sanitization, include TCPdpriv, TCPurify, Crypto-PAn, AnonTool, tcpmkpub, FLAIM,CANINE, CoralReef, PktAnon, Tcpdump Anonymizer, traceanon, WDCap, in the order of most uses.Figures 1–20 show the details of the survey results, including the actual questions, response statisticsand summary of the responses.13 Summary and conclusionThis information from the survey feedback will help us to refine our ideas about expressing sanitizationgoals and research usefulness goals, about new anonymization methods, and about new metrics. The infor-mation will also help us to develop the NetSANI framework.1AcknowledgementsThis survey results from a research program in the Institute for Security, Technology, and Society (ISTS),supported by the U.S. Department of Homeland Security under Grant Award Number 2006-CS-001-000001,and by the NetSANI project at Dartmouth College (funded by Award CNS-0831409 from the National Sci-ence Foundation).The views and conclusions contained in this document are those of the authors and should not be inter-preted as necessarily representing the official policies, either expressed or implied, of the U.S. Departmentof Homeland Security or the National Science Foundation.1http://www.cs.dartmouth.edu/∼dfk/papers/index.html#netsaniFigure 1: (Question 1) 84% of the participants have collected network tracesFigure 2: (Question 2) 75% of the participants who have collected network traces, collected pcap traces.2Figure 3: (Question 3) 88% of the participants who have collected network traces, responded that thecollected traces contain some sensitive information.Figure 4: (Question 5) 43% of the participants who have collected network traces, shared their traces withother researchers.Figure 5: (Question 7) 65% of the participants who have collected network traces, intend to share the traceswith other researchers outside their organizations.3Figure 6: (Question 8) 76% of the participants who have collected network traces responded that they donot want to share the traces with other researchers outside their organization, because they need to protectpersonally identifiable information.Figure 7: (Question 9) 84% of the participants who have collected network traces responded that theirmajor concern in sharing the traces with other researchers outside their organization is protecting personallyidentifiable information.Figure 8: (Question 10) Only 55% of the participants who have collected network traces sanitized thetraces.4Figure 9: (Question 11) 71% of the participants who have sanitized their traces used their own software.34% of the participants who have sanitized their traces used third-party tools.Figure 10: (Question 13) On average, the participants who have sanitized are satisfied with their sanitizationtools; score 3.2 out of 5.5Figure 11: (Question 15) 76% of the participants who have sanitized network traces have verified that theirsanitization result is correct.Figure 12: (Question 16) On average, the participants who verified their sanitization result, found it difficultto do so; score of 2.9 out of 5.0.Figure 13: (Question 17) 84% of the participants who verified their sanitization result did not use anyquantitative metric to measure the strength of the sanitization.Figure 14: (Question 19) 76% of the participants who verified their sanitization result agree that the saniti-zation they applied limits the usefulness of the network traces.6Figure 15: (Question 20) 92% of the participants who have verified their sanitization result did not use anyquantitative metric to measure how much the sanitization actually reduced the usefulness of their networktrace.Figure 16: (Question 22) 61% of 18 respondents have used network traces for their research.Figure 17: (Question 23) All of 11 respondents have obtained the network traces by downloading fromon-line network data archives.7Figure 18: (Question 24) 72% of 11 respondents have used IEEE 802.11 network traces. 27% of therespondents have used pcap traces or syslog.Figure 19: (Question 25) 55% of 11 respondents noticed some sensitive information in the traces theycollected.Figure 20: (Question 27) 49% of 86 respondents have never heard of, nor used, any of these sanitizationtools8

User survey regarding the needs of network researchers in trace-anonymization tools

https://digitalcommons.dartmouth.edu/cgi/viewcontent.cgi?article=1333&amp;context=cs_tr

User survey regarding the needs of network researchers in trace-anonymization tools

Abstract

Similar works

Full text

Available Versions

Dartmouth Digital Commons (Dartmouth College)