  Searchable symmetric encryption enables private queries over an encrypted
database, but it also yields information leakages. Adversaries can exploit
these leakages to launch injection attacks (Zhang et al., USENIX'16) to recover
the underlying keywords from queries. The performance of the existing injection
attacks is strongly dependent on the amount of leaked information or injection.
In this work, we propose two new injection attacks, namely BVA and BVMA, by
leveraging a binary volumetric approach. We enable adversaries to inject fewer
files than the existing volumetric attacks by using the known keywords and
reveal the queries by observing the volume of the query results. Our attacks
can thwart well-studied defenses (e.g., threshold countermeasure, static
padding) without exploiting the distribution of target queries and client
databases. We evaluate the proposed attacks empirically in real-world datasets
with practical queries. The results show that our attacks can obtain a high
recovery rate (>80%) in the best case and a roughly 60% recovery even under a
large-scale dataset with a small number of injections (<20 files).
