QUIC-CNN: Website Fingerprinting for QUIC Traffic in Tor Network

Abstract

The Onion Router (Tor) network is an anonymous network that provides anonymous proxy services to TCP applications, which has brought great obstacles to network traffic analysis. However, we can still get useful information from the metadata of the traffic by Website Fingerprinting (WF) attack. WF attacks can effectively determine which website a user visited over an encrypted connection. There are many studies on WF attacks on the Tor network, such as the state-of-the-art model Si-DF [20]. However, the next-generation HTTP Protocol will only support QUIC protocol as its transport layer protocol, while there are no studies about WF attacks on QUIC traffic on the Tor network. QUIC's characteristics are different from TCP(e.g., Encrypted transport), which makes WF attacks harder to perform in the Tor network using QUIC protocol. In this paper, we propose QUIC-CNN, a novel model for WF attacks towards QUIC traffic in Tor networks. We compared QUIC-CNN with Si-DF in a series of experiments. The evaluation results show that QUIC-CNN performs much better than Si-DF in website fingerprinting towards QUIC traffic in the Tor network.