From Plaintext to Encrypted: What Your Router Can Still Infer

Motivation

Sensing behaviour from network traffic is quietly running out of runway. DoH, ECH, and QUIC are encrypting the very metadata that made it possible: DNS names, the server name in TLS, packet headers. The signals CareNet reads to infer household rhythms are disappearing from the wire, one protocol at a time [1], [2], [3].

That is a threat and an opportunity. If a home router can still infer behaviour from fully encrypted traffic, that is a privacy risk worth measuring precisely. If it cannot, privacy-preserving encryption is winning, and we should know exactly where the line falls. Neither answer is obvious: a decade of traffic-analysis research shows that timing, packet sizes, and burst patterns leak far more than people expect, even under encryption [4], [5], [6], [7], [8].

This thesis puts a number on it. You will measure which behavioural indicators survive at each step of the encryption ladder, and rebuild the ones that break from timing alone.

Problem statement

CareNet infers DSM-5 depressive indicators from header-level router metadata, never touching payloads. But its features assume metadata that modern protocols are erasing: DoH hides DNS lookups [1], ECH hides the server name [2], and QUIC moves the headers inside encryption [3]. Nobody has mapped, indicator by indicator, what CareNet actually loses at each encryption level, or whether timing-based features can recover it.

That is the gap. This thesis measures it on a controlled router, classifies every behavioural feature as survives, degrades, or breaks, and designs timing-based replacements (traffic rhythms, session durations, burst patterns) for the ones that break.

Research questions

1. At what point on the encryption ladder (plaintext DNS, then DoH, then DoH with ECH, then QUIC-only) does each CareNet behavioural indicator stop being observable?
2. Which indicators survive on timing, packet sizes, and burst structure alone, the features that encryption does not hide [4], [6]?
3. Can timing-based replacements recover the lost signal well enough to keep CareNet’s DSM-5 readouts meaningful, and at what cost to accuracy?

Suggested methodology

1. Build a controlled lab router that can serve the same household traffic at four encryption levels: plaintext DNS, DoH, DoH with ECH, and QUIC-only.
2. Re-extract CareNet’s features at each level and label each one survives, degrades, or breaks.
3. For broken features, engineer timing-based replacements (inter-arrival rhythms, session durations, burst patterns), drawing on the traffic-analysis literature [4], [5], [6].
4. Re-run CareNet’s Fuzzy Additive Symptom Likelihood on the recovered features and measure how much of the DSM-5 readout you keep.
5. Report the encryption level at which behavioural sensing genuinely breaks, a clear privacy result either way.

What you need: networking fundamentals (TCP/IP, DNS, TLS), Python, and measurement discipline. No machine-learning background is required, we bring the CareNet side.

Previous theses in this line

The direct predecessor:

• At the Edge of Empathy: Mental-Health Awareness Through Home-Router Network Traffic Insights, Stephan Nef, and the paper CareNet: Linking Home-router Network Traffic to DSM-5 Depressive Behavior Indicators (Nef and Rodrigues, NOMS 2026).

The wider sensing-for-mental-health thread this topic belongs to:

• Audio-centered Approach for Building a Multimodal Predictive AI Agent to Detect Depressive Behaviors, Jonas Länzlinger (IHearYou), sensing from speech.
• Explainable Multimodal-based Depression Awareness at the Edge, Tibor Haller (CML), combining modalities with context.

References

[1] P. Hoffman and P. McManus. “DNS Queries over HTTPS (DoH).” RFC 8484, IETF, 2018.

[2] E. Rescorla, K. Oku, N. Sullivan, and C. A. Wood. “TLS Encrypted Client Hello.” IETF draft-ietf-tls-esni.

[3] J. Iyengar and M. Thomson (Eds.). “QUIC: A UDP-Based Multiplexed and Secure Transport.” RFC 9000, IETF, 2021.

[4] A. Panchenko, F. Lanze, A. Zinnen, et al. “Website Fingerprinting at Internet Scale.” Network and Distributed System Security Symposium (NDSS), 2016.

[5] J. Hayes and G. Danezis. “k-fingerprinting: A Robust Scalable Website Fingerprinting Technique.” USENIX Security Symposium, 2016.

[6] P. Sirinam, M. Imani, M. Juarez, and M. Wright. “Deep Fingerprinting: Undermining Website Fingerprinting Defenses with Deep Learning.” ACM Conference on Computer and Communications Security (CCS), 2018.

[7] N. Apthorpe, D. Reisman, S. Sundaresan, A. Narayanan, and N. Feamster. “Spying on the Smart Home: Privacy Attacks and Defenses on Encrypted IoT Traffic.” arXiv:1708.05044, 2017.

[8] A. Sivanathan, H. H. Gharakheili, F. Loi, et al. “Classifying IoT Devices in Smart Environments Using Network Traffic Characteristics.” IEEE Transactions on Mobile Computing, 18(8):1745-1759, 2019.