Mirage: Real-Time Network Traffic Evasion with Deep Reinforcement Learning

Traffic analysis is integral to network management. Despite encryption, attackers can deduce privacy elements such as user behavior and OS identification using advanced learning-based methods that exploit side-channel features. Existing defenses manipulate feature distribution to evade traffic analyzers, but symmetric framework methods require impractical decoder deployment across all routes. Moreover, reversing feature distribution modifications to real-time traffic is complex, especially through dummy packet crafting or padding. To address these issues, we propose Mirage, a practical, asymmetrically deployable live connection defender against encrypted network traffic analyzers. Mirage reconstructs live streams at the packetblock level, allowing deployment on any connection node to enforce transmission constraints. Utilizing a traffic-customized DQN framework, Mirage reverses statistical feature perturbations to traffic space while directing distribution towards a target class. Experiments on real-world datasets show Mirage efficiently evades analyzers in both targeted and untargeted modes, outperforming existing defenses. Code of Mirage is available at<sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">1</sup><sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">1</sup>https://github.com/SecTeamPolaris/Mirage.