 Please give a very warm applause to Stefan Burschka So I'm expected to speak now, right? I didn't expect so many people actually, so it's a great honor for me to be at the Kau's computer club conference because it's my first time I never expected to be here actually and I'm actually not a hacker so my formation is physics and I deal with traffic data and I also deal with troubleshooting large infrastructures large infrastructures is something like 10,000 20,000 pieces of equipment router switches any operating systems humans in it so pretty complicated stuff and when something goes wrong and They don't find the problem. You need to figure out where something happens and Then when you in that business you start developing Tools for you one week of open source here fertilizer hint hint and Then when I was asked to have this talk here. I said, okay The people are not minors the people are hackers really smart people. So I will talk about listening to packets So packets are actually something like that what you see here So I have my laser pointer here. I can kill you so this here and What you need is an ear who knows Snoop Nobody knows. Oh great. You know on a spark five or spark one They took this feature out I guess but there was a there was a command line switch Which routed the traffic to the amplifier and then to the loudspeaker and you could listen to traffic And actually you could your ear is amazing. It does a foyer transfer. Does anybody know that it's cool cool stuff And you you're in you are Actually in nerd against noise and when something happens whoop your brain detects it so the idea is actually to do that with IP traffic as well and As everybody everybody can do that. I guess if I play a tune After a few seconds, you know, what kind of tune that is Some people are so good. They identify the singer So you actually can do that with IP traffic as well So when I get that idea There's this poor guy Benoit do Pusky he was a student master student, so I worked with him on that and Actually he got for his thesis. He got a science prize at the PFL and now he does his PhD in Belfast So unfortunately, he's not here today so But smart guy So the contents Who what why I will tell you who we are what we are doing and why we are doing it I give you a short introduction to traffic mining who wants more just comes up to me and I teach you then Engineering approach, so we will need some engineering stuff in that something like transfer functions stuff and then Traffic mining signal analysis, but I will keep it simple There's some math in it, but I will explain it different. I'm I'm a private pilot I fly gliders a love flying glider, so I will explain it with airplanes And then I will give you some results and then you can ask me questions so this is actually the group some people are actually here and Yeah, the guy with glasses is clear who that is and we really stick together before we came to this company here We worked at a great operator really big one and We had some of these Looney projects there and I tried to educate young guys, especially here, which are in far beyond To actually go for the moon To do impossible things and you won't believe it these guys can do it and Then the people are 20 or 21 and then they're actually at at the university right? so I educate my own guys and There's a question mark. That's a hint. We are looking for people So we also working with universities So sometimes I pull people in and I do bootcamp So the people come to me and I make them suffer for one week or two weeks and then they can do these things So if somebody wants to do bootcamp come to us so what? Network troubleshooting you need three two things one is to discover the network a lot of people don't know What the network what is actually in there what it's doing? So we did something Like Nino that's Nina. It's out of discovery tranquilizer if you are dealing with one terror 10 terror 20 terror of traffic you need something that digests that and and transfers that into a flow or Into that right and then we do something like operational pictures and I had this problem Looking at 11 or 20 dimensions Who can understand here four dimensions? I mean visually. Oh, yeah. Okay. How do you do that? Okay, then six six spatial seven 20, okay There's Tom Tom rules smart guy and he's working with us. He's actually from University of Marlborough and These are maps so what you see here is something like one terror of traffic 10,000 IP addresses in it and 11 dimensions and you can identify regions now 10 regions and you can see it. It's projected What two dimensions? So and you can here identify an anomaly So that's actually the map we want to use. It's does anybody know co-owned maps Okay, that's a total different story Needs another talk. So if I give a workshop or something I will explain that to you then automatic protocol learning So you give me traffic we reverse engineer the state machine of the traffic Automatically until you to feel master student did that also really smart guy and This here that's the next generation protection Something like evolving an immune system and as I heard somebody will do a lightning talk about that Sometimes so if you're interested go there so It's Christmas you see packets visiting around so One direction and here the direction coming back So what's in it? Can you tell me? How do you guess that? No, I don't know I blindfold you. Okay, you're blindfolded. We make it easy. I take packets Me packets and I shift them over the floor right shift them and If they are heavy or not They have the same velocity What is in there? No, you cannot privacy and your bribe you're blindfolded or it's in the tunnel So I want you I tell you there are some animals in it elephants Tigers so don't open it you get eaten then Butterflies flies whatever how do you figure it out anybody an idea? You are blindfolded Timing What timing I shift them over the floor and sound yes smart woman sound But what is sound sound? How does the sound is created? Friction. Yes, very smart woman. So Friction so actually we convert Yeah, we have some thermal energy in it, but and we listen to it So what we can guess it actually is actually the material of the box for instance So when you do some physics you figure out They have you The early they stop So you can hear the time you know Could you figure out whether there are elephants whether they are green or yellow elephants in it? Can you do that? But you know are there any green or yellow elephants? Are you nuts? They're great So you can assume There are no green and yellow elephants in it right this is what you do you have priors and then you can guess right What else? You can look at me. I'm an old guy. You have really sensitive ears. I have to lift the box You hear the cracking of my bones The cracking of my bones right the more they crack the louder cracked the heavier the box If I tell you there are elephants and there are hamsters in it From the cracking you could tell There's an elephant there's a hamster, but then I'm sinister I put more hamsters in it And then you're done, but can I fill a box like that with a lot of hamsters? And they have to wait with the elephant as small elephant baby elephant So you get the concept. Okay, we can go all drink a beer or do you want to hear more? okay, good, so Driving money What do we do there is listen what you did here listen see understand and find invariants. I Will show you what they are This is the application here, but the important thing is here So you have down here an IP stack with all its fault and stuff here operating systems They're all flawless right and here applications and they're flawless as well and we are invincible We are flawless as well and organizations are flawless as well That's right No, good, so What we have here we listen down here and we guess what's wrong here Whether there's malware around whether something is misconfigured We listen and tell you what kind of a play application that is or what kind of user So you have something like an SSH connection Whether it's you or him Whether you issued a kill command or he issued a remove command And you can even guess something about the organization, but just looking at one packet Not more that's actually the beginning of boot camp So what is possible what I will not talk today is about as is a command guessing or what you can do in IP tunnels It's earlier work. It's published some of it if somebody is interested he can come to me I Will I will guide him to that we will talk about listening to IP packets in a flow and And it's encrypted and now the question was the origin actually was a problem from the feds so and You know whether you can catch pedophiles when they are communicating encrypted So people said it's impossible to do that. So when I said, okay, it's impossible. Let's try it so what you do You take the packets if he had a time and you have a feature here, which is a packet length and Which is in the header IP had everybody knows the IP header, right? What's the first byte when I say for seven hex Then not everybody knows IP so you have to do boot camp so right so and We try to produce an ear Or something like that or use our brain to interpret that and To answer a question so If you start listening to this here so Yeah, and You end up here When you're done because that's encrypted so if you try now to decrypt it you can do that I'm not the cryptologist people make can't do that. Maybe or maybe not and here's your four five So it's IP version IP version four and has no option All right, that's there here in the blue range There's some information and here you cannot do anything in the end if you start there You end like that Yeah, it's too much effort as well. Is there a simple simpler method hmm so Actually said there's no real theory about it How to do that and what kind of features are relevant? So when you look at traffic you can look at the IP header If you have TCP traffic, you can look at the TCP traffic header UDP header. There's a lot of information around There's TTL. There's IP ID, right sequence numbers when you have look in the TCP header But are they relevant? Are they relevant? Yeah, you're sitting in the front row. Sorry. I was take the guys in the front row here next and then I take the second row Are they relevant? Maybe we don't know that was a minor, right? We don't know so we have to figure out so there are two ways to figure out that so you take a lot of data So let's say you ask the question One class second class third class and then you put put that on a machine some artificial intelligence and then You get something like a paper and the paper award or so, but that doesn't mean you understood the problem So we are interested in understanding the problem. So I Thought That's a good picture. So when you have something encrypted Everybody knows here what the tunnel is imagine trains Trains just going in the tunnel and the question I ask like with the packets what kind of train Where does it go that's easy how many passengers what kind of passengers humans elephants hamsters whatsoever What is color of the t-shirt who sent that packet and the only thing what you can do is listening outside the tunnel and These train tracks in the old days. They had they had this gap for temple temporal reasons Material expansion and then you hear these to them to them. So the velocity you can hear like to them to them to them A slow train to them to them to them. Yeah, and when something is heavy, it's noisier So that's the only thing what you can do. It's like blind being blindfolded and only listening So when you when you listen to that and we just say the sound is proportional to the force So it's not the exact theory what I'm delivering here. It's something like a motivation So we look at the force on the force is this differential of the impulse and I guess everybody knows that everybody wants to school, right? so we differentiate that and We get here the impulse is mass times velocity So we differentiate that plus we differentiate that and the packets On the internet we assume they have all the same velocity Right, they visit around with the same velocity. So This is gone. That's nice. So we have this term So what we do and now if there's a mathematician here, please look away because what I'm doing I Just expand with the packet and packets. They are smooth, right? Okay, they are smooth really smooth and you know expand and you can differentiate them and you get two terms So what is that? The packet per time. Do you know that? packets per time packet rate Time and here Mars per packet So what is Mars? I thought so Mars Is something like the length and This is the packet fire rate. That's actually the interdistance the machine gun your IP stacks fires out the packets So cool. So by thinking we found out two features So let's look at them and then we said, okay, so everybody does HDP DNS all this kind of stuff and at that time Skype Undetectable Skype really hard problem and everybody knows Apollo project John F. Kennedy. We do things because they are hard, right? So we thought we looked at Google talk zip. That was too easy. So we took Skype poor Benoit so then There are many undocumented codecs and there was the silk at that time was there was undocumented interesting and so The others they have a pause sending packets so you could easily detect when the speaker has a pause That's so easy, right? We don't do that. We like Skype which constantly fires that that's really a Really difficult problem and the Skype guys are really cool really love what they did I mean, they are gorgeous these guys beautiful minds and Then we said hmm if we know what kind of sentence we have Could we detect which Skype conversation has this? Sentence in there. What we do now is what I threatened I picked one or two and we do now an exercise feature extraction. What do you see? I'll ask him What do you see? Yeah, good. Do you have any question? Anybody having a question? Ah, what's the green and what are the blue ones? What's the correct question? Yeah, very very good. Okay, so the green ones Denote the communication between between two peers the blue ones are out to super notes Okay, very good. No, you have information Next What is what do you see here? Anything come to your mind you Sorry, you're sitting in the front row. Oh Way flat Well We have to talk you understand wavelets See you're in trouble The timescale. Yeah. Yeah, but you know, that's just a resolution. That's to confuse you Okay, go ahead. Ah, so okay. Good. I do that. Yeah Next Hey, hey, listen, you I just wait here. Yeah The regularity at the end he says so you mean this year or you mean this year Yeah, cool cool guy. Yes, that's the first thing what comes to mind here is that and you see this is above zero When you look at the other applications They have packet length with zero so the first Skype detector of the very first version now They are smarter was minimum packet length equals three And Skype was impossible that's this and that's the pink This is very old Skype, right? And here are supernotes and Here, what is that and what is that here? There's sinister Why does the packet length go down? Codding at up the filters so you actually could see That this is Codding training Trying to figure out how can you optimize the packet sending and receiving And that was me That was Dominic a student at that time. He had windows and linux at that at that time You could just buy the packet length being used for the communication say which operating system that is even if it's UDP TCP is easy, right? But even if it's UDP so now this is no different And this is somebody who stalks slow here to listen you see a lot of Movements here, and that's the guy who talks a lot Yes, that's me so And then when I saw that I thought oh, maybe there's movement. Maybe we can do that Right, so we identified now features and you guys did now a mining approach by looking at it Not by using some some elaborate method By looking at the data and that's very important to look at the data and to understand the data very important So the first thing what you need is a hypothesis So engineers around Lift your hands electrical engineers. Yes. Good. So a transfer function the existence of a transfer function of the audio input that comes from you from the microphone and The observed observed IP packet length. So we said There exists a transfer function but transfer functions are linear, but we said what the heck we tried out and then Output the output what we measure is predictable and then given the output the input can be estimated That's our strong hypothesis. Okay Then We have parameters which influence so that's about understanding what's going on there So we have basic signals coming on so they have amplitude They have a frequency. There's will be noise Right, you can do assumptions about it and their silence because there are people who actually stop Sometimes talking I don't but there are people normally so for names. They're for names There are people who do language. They they do a study about languages They are for names. There are words and their sentences. They exist. That's actually the prior There are no yellow and green elephants. So we already know something That's very important. The next is Everybody uses Skype who uses Skype? see everybody so and Then to make things easy at the beginning we only use UDP communication only communication between two peers because It's otherwise so damn difficult enough. So we Just started what I say simple and then English Everybody speaks English. I speak English everybody Okay, so that's a basic lab setup. You have two laptops or you have computers. You have operating systems on them and they exchange packets So you have different speakers. It's not only the same speaker So when we have a woman's voice or male voice How does influence? How does this influence the packet length? We don't know we have to do the experiment And there was a nice guy who was actually into voice recognition I had a huge database with different speakers and different sentences in it a humongous database So we did the experiment So We know something about Skype. There's something about Skype to read so we know there's cryptography in it We know there's a network layer. We know there's sound cards. We know There's something different speakers and we know but there's software in there So these are things we know so we could use them Against these guys again with the green and yellow elephants And then the transfer function that means You put something in like a step and you here you have your black box and you Just see something coming out. Does anybody know what kind of filter that is? High pass or low pass? Thank you very much. Yes, you know, we thought okay. That's so easy. Let's try that Okay, let's try that. Oh damn You know you expect you do first. Oh, we did with it a lot I mean we did everything what engineers tried to try to do and when you expect doing a frequency sweep you get this Oh damn, so there's something really complicated in that something that changes per frequency optimizes So you could now start looking at the codec That's actually a smart thing because they cannot change what the codec does they can change their program But they never can change the codec they use and you have certain requirements for a codec to Actually receiving packets. Otherwise, he can't do his adaptive filtering and predicting business anymore But this year. Yeah, it's a bit rising. But oh it's going like that So hmm, we did other experiments and figured out in the end That's guy business That's our model You know every scientist needs a model. So we said, okay, here come the trains and Here's the codec and he tries to unload something in the train and they have different speeds When you have different speeds here here you have a higher speed here of a lower speed Then something of that goes in there and then something in there and the next one is empty and so on and that somehow Explained this behavior and then we were very content and drank a lot of beer and thing but it doesn't really solve the problem, right? But it helps that's our understanding. I know it's wrong, but you the cow is round all animals around the first development it's so Now, okay, we do serious business. We don't do round cows anymore. We go now serious restore Understood the engineering approach Assuming the system is linear and we can do fit do everything what engineers do in order to understand That didn't work so much so hmm So, okay, we need something more with more juice. So it needs to be learned It needs to be learned. So the task is again You listen to this here These are the packet lengths and You know your phonemes in it everybody use words everybody uses sentences So we somehow need to find a mapping Okay We need to produce invariants and invariant is something that does not change when you change The environment so when you have different speakers when you have a different skype version When you use something else as an encryption, it does not change right It's something like when when I say animal You come up. What doesn't change by an? animal animal No, you you sit in the front row. Sorry Animal if you have to characterize an animal and It's human. What's the first different? You're blind. No, you're not blindfolded. You can look at it, but you may not listen Yeah, you could Easier think simple. How about looking at the legs? Yeah, we take many animals we take hamsters we take elephants we take giraffes we take dinosaurs they died out But you know they had four legs some of them So you get something like a 98% Probability that when you look at the legs and they are four and two then Okay, that's a human that's an animal and then you meet a cephalo raptor and then you're fucked right But he's died he died out. So yeah, but you know, it's a probability. So it's a good feature And not if you live Many million years something like 65 or 100 million years ago, but we don't so we have to produce something like that so We looked at the phone name we had a phone name database So this is pleasure, right and that's the signal. Yeah So we have 44 for my names in order to prove that we have to prove this a mapping a homomorphism, yeah that This is here valid and That's a tremendous lot of work, but we did it and we figured out We didn't find anything except For the signal length and silence So signal to silence so people will think it's trivial But estimating when you have silence because it changes. It's not trivial. I said, okay, let's use that then word construction when you When you have to take a very simple approach and we like to do a simple approach at the beginning is not easy as well then noise silence Estimation when you can estimate that is silent and that's a signal if You don't do that You're done. So you have to estimate silence and the longer the sequence The better the results so the longer somebody talks like me the better the results if somebody talks only two or three words Very difficult So we decided sentence detection. We do simple things Sentence detection here. You have a sentence Yeah, it's a really silly sentence like the frog prevents them from arriving on time anybody flying with planes here So this happens. So that's actually the sentence So we think we saw same sentence similar output not same similar So we have a chance With some statistical means and that's very good news Here we have different sentences Yeah, I put a bomb in the train. Yeah, I don't know who to where I get this sentence from and the thinker is a famous Sculpture and you know, sometimes we talk bullshit here. So you see it here. So you can see with the naked eye there are differences and What when you look at that what what do you see is there something you recognize a feature in both signals Bit louder Yes, absolutely So by looking by looking at it you have to look at the data and you see similarities you see here and here Good and what you see here is actually they have different lengths. Hmm. How do you deal with different lengths? Oh damn so We needed something that can compare Signals with different lengths. So how do you do that? Yeah, there's something like hidden mark of models. So we thought, well, okay, but you know, well too complicated Let's do something Easier dynamic time whooping and that actually takes one signal and the signal signal and now Maps and onto each other in time. So you see here one point correlates to two points and tries to find an optimal path Expands one signal compresses one signal and tries to figure out an optimal path and then gives out a number and says these signals are so Comparable. So here we see two signals And what you see here this blue means very very Similar actually the same and the red areas. So if you compare this here to that or this here to that So this year to anywhere to this similar. It's dissimilar. So it's red and What you do is actually you compare two values and Do something like an Euclidean Difference so between two vectors. You have two vectors and here is the angle and when the angle is like that It's different when the angle is zero. It's almost the same right So With two signals, which are very different So we have two sentences very different. You see are all red and that would be the optimal path, but No way, they're different. So we have a means actually to figure out which signal Signals are the same and which signals are not so if we know the sentence we could create a model and Then we could compare it to all Skype conversations and then figure out Where is a similar signal that should have this meaning but now there's a problem. What's the problem? Thank you very much Absolutely different speakers. So what you do with that? Oh damn hmm So It's bigger dependent. So we actually we figure it out We can do in the average 66 percent that doesn't sound much But actually if you can do that, you're pretty you're pretty good and when you we had 83 correct guesses under certain assumptions, right so But different speakers. Hmm, how do you deal with that? Engineering Kalman filter does anybody knows I love Kalman filters because it's from the 60s. I'm an old guy Right, they're really cool. Yeah, so they actually are able You can measure something even it has a control input like in like an airplane and then you can estimate What's the next expected sample? So this is can average From many speakers it can produce a model of a signal which is correct for all speakers And it works repetitively and these are all complicated matrixes and stuff, but you can do an assumption and Then you make all these things constant and then it's pretty easy So if somebody has questions when somebody has questions you can come to me But now I promise you I explain your Kalman filters. So I do it. We do it with airplanes hmm, so Imagine you're somebody right a guy in the old in the old days and you want to track a plane and you have Here Bob and Alice and you guys, you know, you're a cryptolo just guys, you know, there's Bob and Alice and You get from them Points points in time and space these points and you know, they are noisy. They are not reliable both are not reliable and You get from them data and you have to trust them or not trust them You have to decide whether I trust them and these are these two independent speakers And now you have to estimate the next position of next reliable position of the plane Without knowing anything if you have a theory about it how a plane flies it helps, but if you don't know anything It's actually our task We have from independent speakers unreliable information Which is noisy where we do not know how this signal is actually produced Yeah, by the IP stack by everything. What's in there, right? It's the same situation. This is what Kalman filters do You get unreliable information and You produce the next good estimate like an average. It's not correct, but you know, it's a good guess Not everything is correct in here, but I guess That's what it's does So we have here an example exactly from a tutorial from somebody else here we estimate We estimate this constant line and here you see the Kalman filter here We have all these unreliable points and now this thing if you tune the parameters like and right and It learns it learns that and you can feed that all kinds of crap, but it will learn to follow that line Hmm. So if this line is changing what happens then Here we are here we have now many speakers these different colors and the Kalman filter is the blue Yeah, and you see here the change the speakers the signals change and this common filter learns Oh, yeah, this is crap. I don't trust it. I just go through It adapts its average and when something really drastically changed and everybody agrees it follows as well This is how you produce a model of independent speakers That's a problem Did anybody see that did you see that I? Had time and now I have packet number here. Hey, come on You don't you have to listen or did you do drink too much beer yesterday? You have to you have to see that's packet number. What's wrong here? Yeah, and Yeah, yeah, it's a difference in speaking speaking speech What what you mean? What's what's wrong here? Different. Yeah, but you know packet number packet one. When does packet one and packet two come? What did I say about packet interdistance? Yes One thing but I could take care of it. I have more fits, but what else? Oh Sorry, the sequence might be wrong Yeah, but there's information in the packets. I could take care of it. I So you mean the difference in time? Yes, absolutely. So this packet could come a second later. Okay. We know that in skype Wouldn't happen right something like 20 30 milliseconds or so, but here we use the packet number not the time and you know, I did this Calculation there and it says time difference and I use the packet number. Why did it work? Thank you very much. Somebody is listening here Okay, so that's why it works and that's about science. You have to be honest if oh, sorry It I said it beforehand that skype has something like a constant packet rate 20 30 milliseconds So that's why it worked with the packet number and it makes things easier So you assume these packets coming in constant times And that can be wrong because there are signals who do not do that and With skype it works, but if you use time Right, and if you use more Pre-processing right invest more work You go higher than 83 percent and you go an average higher than 66 percent So that's an important issue So mitigation techniques, it's not perfect solution So there if somebody wants to do an encrypted communication, he always has a trade-off between performance and Computational power. This is what these skype guys did and they did amazing work I mean, it's really cool Then yeah, you can do padding you can give me all packets have the same size Absolutely, and you can influence the IP stack. You can do queuing. They come with the same rate, but be careful with padding We found a function in an IP sack tunnel And we produce the function which uses the padding against you And then we can do the job as well. So do it right with the padding Or you could add random payload as well Random packets randomize it right, but it's computational expensive but mitigation for you guys easy so conclusions We could under specific ideal Situation as in the lab we could reach 83 percent more elaborate effort. You can go higher Speaker independent methods Kalman filter and there are people who are afraid of Kalman filters and they come hidden Markov models And somebody asked me why didn't you use hidden Markov models? And I said, you know, I didn't know So I tried something that I know and I'm old. I'm sorry. So then mitigation techniques as I said for you guys relatively easy and there was a paper in 2011 and They did that and they produced reasonable results and now here we come And here I come to my final slide So don't be afraid. Yeah, I stopped talking none What you see here there are signals and here you see a gap so if you take the packet you do something wrong You distort the signal Hmm, and that's actually looks like so what you do. Do you put zeros in here? Can you do that? And how do you sample this signal? There's something like Shen who knows certain theory? Yeah, very good. Very good. So So who do you do that and there are metallologies And then we come up with something like that that sounds that looks really silly But that's something like an average which tries to estimate How much of this signal is Relevant for me and to produce something like a cut-off frequency and then I have this signal and this signal I can sample with the twice the frequency and then I can do my signal processing on it and then I'm honest I don't use packets Yeah, I try to do the thing right because they are a lot. This is for instance an HTTP connection a complicated one and If you want to do Some mining and some guessing with signals on that you have to do that job right right so What I tried to convey It's actually this this is he's unfortunately good all the good guys are dead I mean Einstein is that Carl Sargent is that I feel really bad now. So these you have these Science is a way of thinking and this is what I try to teach. It's not applying Methodologies, it's not knowing everything about II. It's not about hacking Somewhere it's about seeing it's about understanding No, and it's not about knowledge. It's thinking what needs to be adopted and the Open source tool we deliver which actually does the preprocessing for that as well, which is very useful for network guys I today I overloaded the version 0 5 7 so on source forge if somebody is Interested giving us feedback because I see a lot of downloads since one and a half years But nobody talks to us and said, okay, that's crap or this is crap. So If you mind Yeah, this me or just try it out and you see here this night and eat and all these ants really cute It's actually here in the back So we might produce t-shirts sometime So if you test it or if you use it you get a t-shirt, maybe right? So that's it. This is my email address Was a pleasure go Ask me questions Questions no questions. I don't believe you I Mean if somebody wants to know more just come to me ask anything We have a question back here wait a moment. So somebody has a question Hi, I just wanted to know what your job is at Ruark, which is a Swiss defense company Yeah, I have I have to kill you if I tell you No, it's it's aeronautical in space and I'm a pilot and I always wanted to work for an Aeronautical and space company, but one of the job is this traffic money and Producing tools and you know, we even give something open source. Is that cool? Yeah, I mean it was developed at the company before but they told us we can give it open source And we give it get back to the companies we give it back to the community That's it, but now you're a target any more questions Hi I really don't know how Skype works, but do you think I know? If the interpretation use CBC I don't understand how you can see something or hurt something with that Okay, there's a guy for bootcamp. So Okay, what I try to convey is I do not decrypt. I just take the packet length, right? So you send packets. No not you Skype sends packets and I take the packet length as a signal and that's it And I just used It as a metaphor to listening to that. It's a signal. It's like I'm talking to you You listen to the signal and now we are building tools Which do the same process? It's not like that. I'm listening on the wire No, really. Yeah, I understand that but you are like trying to see patterns on something that Chair That must be like random So it isn't the idea is not the content you speak of the content. I do not look in the content So you can see patterns on encrypted data No on the packet length So not and the content think about the trains, you know, you don't know what's in the trains but from the Was in the tunnel you can estimate if the train is fully loaded or empty for example, and that is what he uses Okay, thank you. Okay otherwise Come next one now everybody's leaving. Can you guess the sex of the speaker? Yes You can even tell you what kind of under we are the speakers. Wearing no kidding It's hello another question now. What would you do to make Skype more secure now that you know? Thank you. Yeah, I know but let's say if I would play an audio book in the background Would with it more or less keep me secure? No on an on a sound level Very basic sound level is really high. Yes I Mean I said under ideal condition and the ideal condition is you speak Nobody else is speaking That's it. So what your ear and brain is doing, right? This is what we cannot do but that's actually an interesting question. Thank you very much. It's very easy No, let's let's rotate audio books in the background or let's let's put the audio books inside afterwards Absolutely, absolutely, and you could also say the same audio books are a private key for two people to communicate Yes, yeah, that that's another thing so you can add it to that. Thank you. I Mean we just thought something simple, right? More questions Did you ever tried a real learner like who's capable of time series? Yes? Yes, we didn't do that because we wanted to show You can do it even by looking at a very simple if you use these You get higher precision and recall. Absolutely last question Sorry, how you deal with no native speaker better doing mistakes on building the sentences Okay, these are these assumptions. I should have said that that's my fault Everyone who has more questions can meet Stefan outside of the hall and talk a little bit to him. Okay. Thank you