  Unlike IPv4 addresses, which are typically masked by a NAT, IPv6 addresses
could easily be correlated with user activity, endangering their privacy.
Mitigations to address this privacy concern have been deployed, making existing
approaches for address-to-user correlation unreliable. This work demonstrates
that an adversary could still correlate IPv6 addresses with users accurately,
even with these protection mechanisms. To do this, we propose an IPv6 address
correlation model - SiamHAN. The model uses a Siamese Heterogeneous Graph
Attention Network to measure whether two IPv6 client addresses belong to the
same user even if the user's traffic is protected by TLS encryption. Using a
large real-world dataset, we show that, for the tasks of tracking target users
and discovering unique users, the state-of-the-art techniques could achieve
only 85% and 60% accuracy, respectively. However, SiamHAN exhibits 99% and 88%
accuracy.
