PackMorph: Intelligent Traffic Signature Morphing for Privacy-Preserving Communications

Abstract

Machine Learning(ML) models have enabled encrypted traffic classifiers to accurately identify services by analysing side-channel features such as packet sizes, timing behaviour, and burst dynamics, despite the payload itself remaining fully encrypted. These statistical fingerprints enable highly accurate monitoring of user activity, raising privacy concerns.To mitigate this threat, we present PackMorph, a cooperative traffic-shaping framework that counters encrypted-traffic classification. PackMorph employs a synchronised library of invertible statistical transformations to systematically adjust packet sizes, inter-arrival times, and flow volumes, thereby concealing the true identity of network flows and disrupting classifier accuracy.Further empirical evaluation shows that PackMorph consistently forces target traffic to be misclassified as plausible decoy services, significantly reducing detection performance. Real-time emulation in Mininet further demonstrates the system's practical feasibility, achieving 100% lossless data reconstruction for complex workloads such as file transfers while preserving end-to-end protocol correctness. With only modest, policy-controlled impacts on latency and throughput, PackMorph provides a practical and deployable defense against sophisticated metadata-driven surveillance. © 2026 IFIP.