Minos - A Lightweight and Dynamic Defense against Traffic Analysis in Programmable Data Planes

Learn about Minos, a novel programmable switch-based defense mechanism designed to protect against encrypted traffic analysis attacks in this 18-minute conference presentation from USENIX ATC '25. Discover how researchers from Pengcheng Laboratory, Tsinghua Shenzhen International Graduate School, and Northeastern University developed a lightweight and scalable solution that provides both identity and traffic anonymity while maintaining line-rate packet processing. Explore the three core components of Minos: the Proxy Module featuring encryption round compression for high-speed packet header encryption, the Schedule Module implementing dynamic flow scheduling to interleave packets without bandwidth overhead, and the Traffic Morphing Module using priority dummy queues for packet obfuscation. Examine the implementation on Tofino1 switches and see how this approach effectively defends against Website Fingerprinting and IoT Fingerprinting attacks, reducing attack accuracy to below 20% while using only one-tenth the overhead of existing defense mechanisms compared to traditional traffic analysis countermeasures.