An Adaptive Bidirectional Traffic Shaping Mechanism for Service Mesh

The cloud-native microservice architecture provides flexibility and scalability. However, communications between microservices create privacy risks. Attackers can infer sensitive information about microservices by analyzing network side-channel metrics such as packet sizes and arrival time. Current traffic shaping methods lack service-level control, bidirectional shaping, and adaptability to fluctuating traffic. In this paper, we propose TrafficGuard, an adaptive bidirectional traffic shaping mechanism. Specifically, we design a WASM-based service-level bidirectional traffic shaping mechanism to hide the actual traffic characteristics of services and achieve strategy hot updates without service interruption. In addition, we design a sliding window-based adaptive traffic shaping method and a target service identification method to achieve effective traffic shaping with minimal resource overhead.