Webpage Fingerprinting using Only Packet Length Information

Abstract

Encrypted web traffic can reveal sensitive information of a user, such as their browsing histories. Existing studies on encrypted traffic analysis attacks usually focus on traffic fingerprinting of different websites rather than that of webpages from a same website. Fine-grained webpage fingerprinting allows exploiting more private information of users, e.g., their interests within a news website or an online shopping website. Since webpages from a same website usually have very similar features (e.g., statistical information) that make them indistinguishable, existing solutions may end up with low accuracy. In this paper, we propose a novel webpage fingerprinting method based on a simple and comprehensible idea. We make an observation that the length information of packets in bidirectional interaction between clients and servers can be a distinctive feature in webpage fingerprinting. Then, we extract the cumulative length of a sequence of packets to represent the fingerprint of a specific webpage. More precisely, only the first 100 packets in the loading process of a webpage is considered, thus enabling early-stage fingerprinting. The experimental results with real-world datasets demonstrate that our method is superior to other state-of-the-art approaches in terms of classification accuracy and time complexity. To the best of our knowledge, this is the first work on fine-grained webpage fingerprinting.