A Small Data Approach to Identification of Individuals on the Transport Layer using Statistical Behaviour Templates

Our daily life is dominated by constant Internet connectivity. In order to retrieve up-to-date information and to share personal experiences and impressions, our computers and mobile devices periodically communicate with servers or peers. During this data exchange, we constantly leave digital traces on different systems across the communication stack. These traces can be used to compute profiles of individuals. While such profiles may be used to increase user experience and convenience, they seriously affect privacy of individuals. Typically, service providers like Google or Facebook collect gigabytes to terabytes of user payload data to compute user profiles from. That is, they make use of a big data approach. In contrast to that, this paper shows a novel small data approach to compute profiles using behaviour templates derived from IP address and port number statistics. Our use case is to increase network security through concurrent identification. Our approach is capable of identifying individuals with true- and false-positive rates of 0.995 and 0.001, respectively, without relying on payload information, significantly outperforming related work.