Research Associate · University of Waterloo Waterloo, Ontario
Onur Eren Arpacı
Onur Eren Arpacı Papers Updated September 2026

Research

Things I’ve written

Two so far. One is an oblivious storage system fast enough to be worth deploying. The other lets institutions compare network logs without handing them over. The abstracts are below, with the PDF and the code for each.

Cloak: Heuristic ORAM Optimization Through Fixed Temporal Distribution

Onur Eren Arpacı, Florian Kerschbaum, Sujaya Maiyya

IEEE Symposium on Security and Privacy (S&P) · 2027 · Accepted, to appear. Preprint on arXiv, May 2026.

Encrypted cloud storage can hide data contents but still leak sensitive information through access patterns. ORAM addresses this by hiding access patterns, but existing ORAM systems are too inefficient to deploy in practice. We present Cloak, an oblivious storage system that dramatically improves performance by leveraging a simple, widely observed property of real workloads: temporal locality, where recently accessed items are more likely to be accessed again soon. Instead of trying to make server accesses look perfectly uniform, Cloak makes server traffic follow a fixed, “recentness-biased” pattern and then uses real queries to fill as much of that traffic as possible. When the workload exhibits temporal locality, Cloak achieves overheads as low as 1.1× over a non-oblivious and unencrypted baseline. Importantly, this heuristic affects only performance, not security. We evaluate Cloak on Netflix click-stream and Ethereum transaction traces, achieving 165,000 and 157,000 operations per second, respectively, on a single machine.

Over-Threshold Multiparty Private Set Intersection for Collaborative Network Intrusion Detection

Onur Eren Arpacı, Raouf Boutaba, Florian Kerschbaum

23rd USENIX Symposium on Networked Systems Design and Implementation (NSDI ’26) · Renton, Washington, May 2026 · pp. 2211–2226 · Artifact badges: Available, Functional, Reproduced.

An important function of collaborative network intrusion detection is to analyze the network logs of the collaborators for joint IP addresses. However, sharing IP addresses in plain is sensitive and may be even subject to privacy legislation as it is personally identifiable information. In this paper, we present the privacy-preserving collection of IP addresses. We propose a single collector, over-threshold private set intersection protocol. In this protocol \(N\) participants identify the IP addresses that appear in at least \(t\) participant’s sets without revealing any information about other IP addresses. Using a novel hashing scheme, we reduce the computational complexity of the previous state-of-the-art solution from \(O(M(N \log{M}/t)^{2t})\) to \(O(t^2M\binom{N}{t})\), where \(M\) denotes the dataset size. This reduction makes it practically feasible to apply our protocol to real network logs. We test our protocol using joint networks logs of multiple institutions. Additionally, we present two deployment options: a collusion-safe deployment, which provides stronger security guarantees at the cost of increased communication overhead, and a non-interactive deployment, which assumes a non-colluding collector but offers significantly lower communication costs and applicable to many use cases of collaborative network intrusion detection similar to ours.