Inferring communication pairs in end-to-end encrypted messaging applications

Modern messaging platforms have widely adopted end-to-end encryption to secure user communications. However, encryption alone does not prevent adversaries from leveraging traffic analysis techniques to leak information and communication patterns. This poses significant risks, particularly in environments where metadata surveillance is used to suppress dissent, track activists, or monitor sensitive exchanges, such as those between journalists and whistleblowers. In this study, we analyze the extent to which an attacker monitoring network traffic can accurately determine the identity of a target user’s communication partner based solely on the encrypted traffic. We construct a model of user behavior based on real-world messaging data from WhatsApp, simulating communication scenarios and mapping them to observable network traffic patterns. Our approach identifies key metadata features such as message timing, packet sizes, and delivery notifications that enable traffic correlation. Our findings provide actionable insights for enhancing privacy in encrypted messaging applications and highlight the need for stronger defenses against metadata-based surveillance.

Name thesis:degree_name

M.S.

Level thesis:degree_level

Thesis

Discipline thesis:degree_discipline

Electrical & Computer Engr

Grantor

University of Illinois Urbana-Champaign

Year dc:date

2025

Author dc:creator

• Aoun, Tala

Contributors dc:contributor

• Levchenko, Kirill

• network security
• encrypted communication
• timing correlation attacks

Statement dc:rights

• Copyright 2025 Tala Aoun

Language dc:language

en, eng

Handle dc:identifier

https://hdl.handle.net/2142/129271

OAI record oai:identifier

https://www.ideals.illinois.edu/oai-pmh?verb=GetRecord&metadataPrefix=etdms&identifier=oai%3Awww.ideals.illinois.edu%3A2142%2F129271