A feature of search engines is prediction and suggestion to complete or extend input query phrases, i.e. search suggestion functions (SSF). Given the immediate temporal nature of this functionality, alongside the character submitted to trigger each suggestion, adequate data is provided to derive keystroke features. The potential of such biometric features to be used in identification and tracking poses risks to user privacy.For our initial experiment, we evaluate SSF traffic with different browsers and search engines on a Linux PC and an Android mobile phone. The keystroke network traffic is captured and decrypted using mitmproxy to verify if expected keystroke information is contained, which we call quality assurance (QA). In our second experiment, we present first results for identification of five subjects searching for up to three different phrases on both PC and phone using naive Bayesian and nearest neighbour classifiers. The third experiment investigates potential for identification and verification by an external observer based purely on the encrypted traffic, thus without QA, using the Euclidean distance. Here, ten subjects search for two phrases across several sessions on a Linux virtual machine, and statistical features are derived for classification. All three test cases show positive tendencies towards the feasibility of distinguishing users within a small group. The results yield lowest equal error rates of 5.11% for the single PC and 11.37% for the mobile device with QA and 23.61% for various PCs without QA. These first tendencies motivate further research in feature analysis of encrypted network traffic and prevention approaches to ensure protection and privacy.

中文翻译：

---

加密域中的按键生物识别：网络搜索引擎的搜索建议功能的初步研究

搜索引擎的功能是预测和建议，以完成或扩展输入查询短语，即搜索建议功能（SSF）。考虑到此功能的即时时间特性，以及提交来触发每个建议的字符旁边，将提供足够的数据以导出击键功能。在识别和跟踪中使用这种生物特征的潜力可能会危及用户隐私。在我们的初始实验中，我们评估了Linux PC和Android手机上不同浏览器和搜索引擎的SSF流量。使用mitmproxy捕获并解密击键网络流量，以验证是否包含预期的击键信息，我们将其称为质量保证（QA）。在第二个实验中 我们提供的第一项结果是使用朴素的贝叶斯分类器和最近邻分类器在PC和电话上搜索最多三个不同短语的五个主题的识别。第三个实验使用欧几里德距离，仅基于加密的流量调查了外部观察者进行识别和验证的可能性，因此无需进行质量检查。在这里，十个主题在Linux虚拟机上的多个会话中搜索两个短语，并导出统计特征进行分类。所有这三个测试用例均显示出在区分一小群用户方面的可行性的积极趋势。结果产生的最低均等错误率对于单个PC为5.11％，对于具有QA的移动设备为11.37％，对于没有QA的各种PC为23.61％。