# SiamHAN: IPv6 Address Correlation Attacks on TLS Encrypted Traffic via Siamese Heterogeneous Graph Attention Network

arXiv: https://arxiv.org/abs/2204.09465 · HTML: https://mlsanity.com/paper/2204.09465/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 17 of its 56 references that are in the map.
- First posted on arXiv 20 Apr 2022.

## Builds on (most cited first, 17 of 17)

- [Attention Is All You Need](https://mlsanity.com/paper/1706.03762/) (2017)
- [Adam: A Method for Stochastic Optimization](https://mlsanity.com/paper/1412.6980/) (2014)
- [Semi-Supervised Classification with Graph Convolutional Networks](https://mlsanity.com/paper/1609.02907/) (2016)
- [Graph Attention Networks](https://mlsanity.com/paper/1710.10903/) (2017)
- [Inductive Representation Learning on Large Graphs](https://mlsanity.com/paper/1706.02216/) (2017)
- [Heterogeneous Graph Attention Network](https://mlsanity.com/paper/1903.07293/) (2019)
- [A Survey of Heterogeneous Information Network Analysis](https://mlsanity.com/paper/1511.04854/) (2015)
- [A Twofold Siamese Network for Real-Time Object Tracking](https://mlsanity.com/paper/1802.08817/) (2018)
- [Deep Fingerprinting: Undermining Website Fingerprinting Defenses with Deep Learning](https://mlsanity.com/paper/1801.02265/) (2018)
- [Deciphering Malware's use of TLS (without Decryption)](https://mlsanity.com/paper/1607.01639/) (2016)
- [DeepCorr: Strong Flow Correlation Attacks on Tor Using Deep Learning](https://mlsanity.com/paper/1808.07285/) (2018)
- [Entropy/IP: Uncovering Structure in IPv6 Addresses](https://mlsanity.com/paper/1606.04327/) (2016)
- [Clusters in the Expanse: Understanding and Unbiasing IPv6 Hitlists](https://mlsanity.com/paper/1806.01633/) (2018)
- [RAPTOR: Routing Attacks on Privacy in Tor](https://mlsanity.com/paper/1503.03940/) (2015)
- [OS Fingerprinting: New Techniques and a Study of Information Gain and Obfuscation](https://mlsanity.com/paper/1706.08003/) (2017)
- [Practical Traffic Analysis Attacks on Secure Messaging Applications](https://mlsanity.com/paper/2005.00508/) (2020)
- [6VecLM: Language Modeling in Vector Space for IPv6 Target Generation](https://mlsanity.com/paper/2008.02213/) (2020)

## Built on by (most cited first, 1 of 1)

- [CAT: Can Trust be Predicted with Context-Awareness in Dynamic Heterogeneous Networks?](https://mlsanity.com/paper/2512.11352/) (2025)

## Abstract (arXiv)

Unlike IPv4 addresses, which are typically masked by a NAT, IPv6 addresses could easily be correlated with user activity, endangering their privacy. Mitigations to address this privacy concern have been deployed, making existing approaches for address-to-user correlation unreliable. This work demonstrates that an adversary could still correlate IPv6 addresses with users accurately, even with these protection mechanisms. To do this, we propose an IPv6 address correlation model - SiamHAN. The model uses a Siamese Heterogeneous Graph Attention Network to measure whether two IPv6 client addresses belong to the same user even if the user's traffic is protected by TLS encryption. Using a large real-world dataset, we show that, for the tasks of tracking target users and discovering unique users, the state-of-the-art techniques could achieve only 85% and 60% accuracy, respectively. However, SiamHAN exhibits 99% and 88% accuracy.