Tor and VPNs are used by many to be anonymous and circumvent censorship on the Internet. Therefore, traffic analysis attacks that enable adversaries to link users to their online activities are a severe threat. One such attack is Website Fingerprinting (WF), which analyses patterns in the encrypted traffic from and to users to identify website visits. To better understand to which extent WF can identify patterns in VPN traffic, there needs to be a deeper exploration into which extent background traffic in VPNs impacts WF attacks, which is traffic in the stream that the adversary does not wish to classify. This thesis explores how different background traffic types affect WF on VPN traffic. It is done by using existing VPN datasets and combining them into datasets which simulate a VPN tunnel where both foreground and background traffic is sent simultaneously. This is to explore how different kinds of background traffic affect known state-of-the-art WF attacks using Deep Learning (DL). Background traffic does affect DL-based WF attacks, but the impact on accuracy is relatively small compared to the bandwidth overhead: 200 % overhead reduces the accuracy from roughly 95 % to 70 %. WF attacks can be trained without any background traffic, as long as the overhead of the background traffic is smaller than 2 %, without any impact on accuracy. WF attacks can also be trained with background traffic from other applications than what it is tested on, as long as the applications produce similar traffic patterns. For example, traffic from different pre-recorded streaming applications like Netflix and YouTube is similar enough, but not traffic from pre-recorded and live streaming applications such as Twitch. Also, having access to the size of the packets makes WF attacks better than if the size is obscured, making VPNs probably more vulnerable than Tor to WF attacks. Thesis artefacts are available at: https://github.com/gustavRehnholm/wf-vpn-bg / Tor och VPN:er används av många för att ge anonymitet och kringgå censurera i Internet. Därför är trafikanalysattacker som gör det möjligt för angripare att länka användaren till sina onlineaktiviteter ett allvarligt hot. En sådan attack är Website Fingerprinting (WF), som analyserar mönster i den krypterade trafiken mellan användaren och reläet med målet att identifiera webbplatsbesök. För att bättre förstå i vilken ut-sträckning WF kan identifiera mönster i VPN-tunnlar måste det finnas en djupare undersökning i vilken utsträckning bakgrundstrafik i VPN-tunnlar påverkar WF-attacker, trafik i VPN-tuneln som WF-attackeraren inte försöker klassificera. Målet med denna avhandling är att undersöka hur bakgrundstrafik, i olika kombinationer, påverkar WF på VPN-tunnlar. Det görs genom att använda befintliga VPN-datauppsättningar och kombinera dem till datauppsättningar som simulerar en VPN-tunnel där både förgrunds- och bakgrundstrafik skickas samtidigt. Detta är att utforska hur olika typer av bakgrundstrafik påverkar kända WF-attacker med hjälp av djupinlärning. Bakgrundstrafik har en påverkan på djupinlärnings baserade WF-attacker, men påverkan på WF noggrannheten är relativt liten jämfört med overheaden som behövs: 200 %overhead minskar noggrannheten från ungefär 95 % till 70 %. WF-attacker kan tränas utan bakgrundstrafik, så länge bakgrundstrafikens overhead är mindre än 2 %, utan att det påverkar noggrannheten. WF-attacker kan också tränas med bakgrundstrafik från andra applikationer än vad den testas på, så länge applikationerna producerar liknande trafikmönster. Till exempel är trafik från olika förinspelade streamingapplikationer som Netflix och YouTube tillräckligt lik, men inte trafik från förinspelade och livestreamingapplikationer som Twitch. Det är också tydligt att ha tillgång till paketstorlek gör klassificeraren bättre, vilket gör VPN:er förmodligen mer sårbar än Tor. Avhandlingsartefakter finns på följande hemsida: https://github.com/gustavRehnholm/wf-vpn-bg

In recent years, multimedia identification has become important as the volume of digital media has dramatically increased. With music files, one method of identification is audio fingerprinting. The underlying method for most algorithms is the Fourier transform. However, due to a lack of temporal resolution, these algorithms rely on the short-time Fourier transform. We propose an audio fingerprinting algorithm that uses a wavelet transform, which has good temporal resolution. In this thesis, we examine the basics of certain topics that are needed in understanding audio fingerprinting techniques. We also look at a brief history of work done in this field. We introduce a new algorithm, called the Hokua algorithm. We developed Hokua to take advantage of certain properties of the wavelet transform. The algorithm uses coefficient peaks of wavelet transforms to identify a sample query. The various algorithms are compared.

No description available.

Background. Web tracking is a constant threat to our privacy when browsing the web. There exist multiple methods of tracking, but browser fingerprinting is more elusive and difficult to control. Browser fingerprinting works by a website collecting all kinds of browser and system information on visiting clients and then combining those into one set of information that can uniquely identify users. Objectives. In this thesis, we tested three of today's most used web browsers for the desktop platform to determine their ability to utilize one type of countermeasure, attribute spoofing. We aimed at determining how the browsers perform in two cases. The first case is when running with a default configuration. The second case is when the attribute spoofing is improved with the help of both altered settings and installed extensions. We also aimed at determining if the choice of browser matters in this aspect. Methods. The method for determining these goals was to conduct an experiment to collect 60 fingerprints from each browser and determine the effectiveness of the attribute spoofing via a weight-based system. We also used statistics to see the value range for spoofed attributes and to determine if any browser restart is required for certain spoofing to occur. Results. Our results show little to no attribute spoofing when browsers run in their default configuration. However, significant improvements were made through anti-fingerprint extensions. Conclusions. Our conclusion is, if the tested browsers' do not utilize any other type of countermeasure than attribute spoofing, using browsers at their default configuration can result in a user being alarmingly vulnerable to browser fingerprinting. Installing extensions aimed at improving our protection is therefore advised.

There is a transition nationwide on the analysis of forensic evidentiary stains containing biological material from traditional serology to Polymerase Chain Reaction (PCR) methodologies. The increased sensitivity of PCR, the limited number of alleles at each locus, and the necessity of producing unambiguous data for entry into the FBI's Combined DNA Index System make this study of extraction procedures of utmost importance. A "single tube" extraction procedure for blood stains collected onto FTA™ paper and a modified differential nonorganic extraction method from spermatozoa containing mixed stains were analyzed and compared. The extraction success was evaluated by amplification and typing of the amplified fragment length polymorphism, D1S80. These modifications of the nonorganic method utilized gave an improved separation of the spermatozoa-containing mixed stains.

No description available.

Virtual reality systems are increasing in popularity and are being applied to new areas as time moves on. Gaming and entertainment however still remain the most frequent implementation of virtual reality systems. Many applications are delivered over the internet which exposes a system to a number of security threats. This thesis investigates what methods an attacker potentially could use in an attempt to gain knowledge about a virtual reality user, with emphasis on reading user movements. A dedicated testbed is constructed in an attempt to compromise the users integrity based on the raw packet data sent over the network. Our findings indicate that the testbed in theory should be able to identify user actions. Further work is however needed in order to make it useful in an uncontrolled environment. Other methods show promising results, indicating that an attacker could learn what games a user is playing in an application like VRchat. These other methods did however not show indications of being able to reveal information about user movements.

No description available.

No description available.

No description available.