Fingerprinting Attacks Research Articles

SRP: A Microscopic Look at the Composition Mechanism of Website Fingerprinting

Tor serves better at protecting users’ privacy than other anonymous communication tools. Even though it is resistant to deep packet inspection, Tor can be de-anonymized by the website fingerprinting (WF) attack, which aims to monitor the website users are browsing. WF attacks based on deep learning perform better than those using manually designed features and traditional machine learning. However, a deep learning model is data-hungry when simulating the mapping relations of traffic and the website it belongs to, which may not be practical in reality. In this paper, we focus on investigating the composition mechanism of website fingerprinting and try to solve data shortage with bionic traffic traces. More precisely, we propose a new concept called the send-and-receive pair (SRP) to deconstruct traffic traces and design SRP-based cumulative features. We further reconstruct and generate bionic traces (BionicT) based on the rearranged SRPs. The results show that our bionic traces can improve the performance of the state-of-the-artdeep-learning-based Var-CNN. The increment in accuracy reaches up to 50% in the five-shot setting, much more effective than the data augmentation method HDA. In the 15/20-shot setting, our method even defeated TF with more than 95% accuracy in closed-world scenarios and an F1-score of over 90% in open-world scenarios. Moreover, expensive experiments show that our method can enhance the deep learning model’s ability to combat concept drift. Overall, the SRP can serve as an effective tool for analyzing and describing website traffic traces.

A Website Fingerprint defense technology with low delay and controllable bandwidth

Website Fingerprinting (WF) attacks have shown a serious threat to users’ privacy on Tor networks. To resist WF attacks, many defenses have been proposed, of which padding without any delay is the state-of-the-art method. With the extra data overhead, they managed to reduce the accuracy of WF attacks. However, it is challenging to defeat WF attacks effectively while costing low bandwidth and latency. In this paper, we present RanDePad, a traffic protection and obfuscation method. It achieves low delay and controllable bandwidth. RanDePad uses an adaptive random delaying technique to destroy the website traffic’s time distribution characteristics. It could adjust the time interval between the real traffic packets without changing its order and limits the required traffic latency. Through a bandwidth evaluation algorithm, RanDePad evaluates the traffic bandwidth and dynamically adjusts the random bandwidth padding scheme to hide traffic space features. It ensures low and controllable bandwidth overhead. We evaluated the performance of RanDePad against WF attacks under different bandwidth overhead settings. Experimental results show that with the same total bandwidth overhead and 5.89% total latency overhead, RanDePad can decrease the state-of-the-art attack DF accuracy from 94.57% to 62.40%, while the Front reduces it to 71.01% and the WTF-PAD to 86.44%. Furthermore, when the accuracy is defended to 70%, our method consumes only 21.66% total bandwidth overhead, which is half of the Front and WTF-PAD. In addition, the single bandwidth overhead of RanDePad is also lower than the existing defenses, where the Font spends three times as much as RanDePad does. The results indicate that the RanDePad performs better than the current state-of-the-art WTF-PAD and FRONT methods.

Few-shot Website Fingerprinting attack with Meta-Bias Learning

Website fingerprinting (WF) attack aims to identify which website a user is visiting from the traffic data patterns. Whilst existing methods assume many training samples, we investigate a more realistic and scalable few-shot WF attack with only a few labeled training samples per website. To solve this problem, we introduce a novel Meta-Bias Learning (MBL) method for few-shot WF learning. Taking the meta-learning strategy, MBL simulates and optimizes the target tasks. Moreover, a new model parameter factorization idea is introduced for facilitating meta-training with superior task adaptation. Expensive experiments show that our MBL outperforms significantly existing hand-crafted feature and deep learning based alternatives in both closed-world and open-world attack scenarios, at the absence and presence of defense.

SAD: Website Fingerprinting Defense Based on Adversarial Examples

Website fingerprinting (WF) attacks can infer website names from encrypted network traffic when the victim is browsing the website. Inherent defenses of anonymous communication systems such as The Onion Router(Tor) cannot compete with current WF attacks. The state-of-the-art attack based on deep learning can gain over 98% accuracy in Tor. Most of the defenses have excellent defensive capabilities, but it will bring a relatively high bandwidth overhead, which will seriously affect the user’s network experience. And some defense methods have less impact on the latest website fingerprinting attacks. Defense-based adversarial examples have excellent defense capabilities and low bandwidth overhead, but they need to get the complete website traffic to generate defense data, which is obviously impractical. In this article, based on adversarial examples, we propose segmented adversary defense (SAD) for deep learning-based WF attacks. In SAD, sequence data are divided into multiple segments to ensure that SAD is feasible in real scenarios. Then, the adversarial examples for each segment of data can be generated by SAD. Finally, dummy packets are inserted after each segment original data. We also found that setting different head rates, that is, end points for the segments, will get better results. Experimentally, our results show that SAD can effectively reduce the accuracy of WF attacks. The technique drops the accuracy of the state-of-the-art attack hardened from 96% to 3% while incurring only 40% bandwidth overhead. Compared with the existing proposed defense named Deep Fingerprinting Defender (DFD), the defense effect of SAD is better under the same bandwidth overhead.

RegulaTor: A Straightforward Website Fingerprinting Defense

Abstract Website Fingerprinting (WF) attacks are used by local passive attackers to determine the destination of encrypted internet traffic by comparing the sequences of packets sent to and received by the user to a previously recorded data set. As a result, WF attacks are of particular concern to privacy-enhancing technologies such as Tor. In response, a variety of WF defenses have been developed, though they tend to incur high bandwidth and latency overhead or require additional infrastructure, thus making them difficult to implement in practice. Some lighter-weight defenses have been presented as well; still, they attain only moderate effectiveness against recently published WF attacks. In this paper, we aim to present a realistic and novel defense, RegulaTor, which takes advantage of common patterns in web browsing traffic to reduce both defense overhead and the accuracy of current WF attacks. In the closed-world setting, RegulaTor reduces the accuracy of the state-of-the-art attack, Tik-Tok, against comparable defenses from 66% to 25.4%. To achieve this performance, it requires 6.6% latency overhead and a bandwidth overhead 39.3% less than the leading moderate-overhead defense. In the open-world setting, RegulaTor limits a precision-tuned Tik-Tok attack to an F 1-score of. 135, compared to .625 for the best comparable defense.

A Method for Identifying Tor Users Visiting Websites Based on Frequency Domain Fingerprinting of Network Traffic

Although the anonymous communication network Tor can protect the security of users’ data and privacy during their visits to the Internet, it also facilitates illegal users to access illegal websites. Website fingerprinting attacks can identify the websites that users are visiting to discern whether they are performing illegal operations. Existing methods tend to manually extract the traffic features of users visiting websites and construct machine learning or deep learning models to classify the features. While these methods can be effective in classifying unknown website traffic, the effect of classification in the use of defensive measures or onion service scenarios is not yet ideal. This paper proposes a method to identify Tor users visiting websites based on frequency domain fingerprinting of network traffic (FDF). We extract the direction and length features of circuit sequences in access traffic and combine and transform them into the frequency domain. The classification of access traffic is accomplished by using a deep learning classification model combining CNN, FC, and Self-Attention. In this paper, the proposed FDF method is experimentally validated in common scenarios of Tor networks. The results show that FDF outperforms the existing methods for classification in different Tor scenarios. It can achieve 98.8% and 94.3% classification accuracy in undefended and WTF-PAD defense scenarios, respectively. In the onion service scenario, the accuracy is improved by 4.7% over the current state-of-the-art Tik-Tok method.

Dissecting traffic fingerprinting CNNs with filter activations

HTTPS encrypted traffic flows leak information on underlying contents through various statistical properties such as packet lengths and timing, enabling traffic fingerprinting attacks. Recent traffic fingerprinting attacks leveraged Convolutional Neural Networks (CNNs) to record very high accuracies undermining state-of-the-art defenses. In this paper, we analyze such CNNs to understand their inner workings which helps in building efficient traffic classifiers and effective defenses. First, we experiment on three datasets and show that website fingerprinting CNNs focus majorly on transitions between uploads and downloads in trace fronts while video fingerprinting CNNs focus more on finer shapes of periodic bursts. Next, we show that traffic fingerprinting CNNs exhibit transfer-learning capabilities allowing identification of new websites with fewer data. We also demonstrate how traffic fingerprinting CNNs outperform Recurrent Neural Networks (RNNs) due to their resilience to random shifts in data, which is common in network traces. We further generalize these observations on other publicly available network traffic datasets. Leveraging our observations, we propose two new defenses against traffic fingerprinting. Our first defense FRONT-U, defends website visits by obfuscating transitions between uploads and downloads in trace fronts and provides similar privacy as the state-of-the-art defense FRONT, with half the data overhead. Our second defense STOMA, defends streaming traffic by obfuscating the finer sub-bursts within major bursts of a trace using only the next few seconds as opposed to using the entire trace as in the state-of-the-art.

A novel model for voice command fingerprinting using deep learning

Smart speakers are becoming increasingly popular and permeate many aspects of human life. To improve the security of smart speakers, voice commands transmitted over a network are encrypted; however, user privacy issues related to smart speakers continue to emerge. In fact, attackers are still able to infer the content of a user’s specific voice commands from encrypted traffic through machine learning methods to obtain private information for advertising or to carry out malicious attacks. This traffic analysis attack is referred to as a voice command fingerprinting attack. In recent years, research on improving the accuracy of voice command fingerprinting attacks has become a hot topic and remains a challenging task. To improve the accuracy of voice command fingerprinting attacks, we design a new method in this paper. We use an adaptive and dilated residual network to process spatial features. In addition, we find that using temporal features helps improve fingerprinting attack accuracy, and therefore design an attention-based bidirectional gated recurrent unit. Then, we effectively combine the two models. Our method achieves an accuracy greater than 93.36% in a closed-world scenario, which exceeds those of other state-of-the-art methods (2020 WiSec Wang et al.). In a more realistic open-world setting, our model is still effective, obtaining a true-positive rate of 99.50% and a false-positive rate of 0.1% compared to Sirinam et al.’s rates of 90.66% and 0.1%, respectively. We also demonstrate that our model has good generalizability, as our model can also be applied to website fingerprinting and outperforms 2018 CCS Sirinam et al.

An improved video fingerprinting attack on users of the Tor network

In today’s digital age, there is less and less doubt that companies, governments, and hackers track our online patterns and collect personal data. Thus, over 2 million users daily flock to the Tor network, which secures their online identities by encrypting their traffic. Although the Tor network is often considered secure, it is vulnerable to fingerprinting attacks that threaten users’ online privacy. Using machine learning, these attacks attempt to classify which web page the victim is visiting based on the page’s unique traffic patterns. Since video streaming makes up 80% of total downstream web traffic, we aim to explore how well this content can be fingerprinted in Tor. In this paper, we develop a new video fingerprinting model. Our model is based on a random forest classifier, a supervised machine learning algorithm that assembles decision trees for various samples and classifies based on their majority vote. Our model uses 247 features from video traces to exploit the burst patterns present in video traffic that are unique to each video. Our model is able to distinguish which one of the 50 videos a user is hypothetically watching on the Tor network with 85% accuracy, which outperforms the state-of-the-art, Deep Fingerprinting model’s accuracy of 55%. This demonstrates that video fingerprinting poses a serious threat to the privacy of Tor users. Our model performs better as it is adjusted to consider the bursts that are streamed from video traffic’s DASH protocol.

SnWF: Website Fingerprinting Attack by Ensembling the Snapshot of Deep Learning

The website fingerprinting (WF) attack enables a local eavesdropper to identify which website a client is visiting under encrypted network connections. By leveraging deep neural networks, the state-of-the-art WF attacks achieve high accuracy in classic experimental scenes. However, due to the high variance of neural networks, those attacks are sensitive to the specific information in the data and would result in less-than-ideal performance on data outside the training set or on data that is impacted by the effect of concept drift. In this paper, we present snWF, a novelWF attack, which leverages an out-of-the ordinary ensemble to reduce the variance of neural networks and improve the robustness of the attack. In a large open-world setting with 400,000 websites, snWF manages to determine whether a user is visiting a monitored website, with a true positive rate of 98.1% and a false positive rate of 5.7%. We also evaluated snWF in a more realistic attack scenario, termed as <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">wide-world</i> , to examine whether snWF can correctly classify websites that even an adversary has not seen before, and we found that snWF achieves a higher classification accuracy than the state-of-the-art attacks in this new setting. In addition, in the face of concept drift, snWF is found to be more resilient than any other attacks. Moreover, we are the first to reveal that under concept drift WF attacks suffer more severe performance degradation in a <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">open-world</i> setting than in a <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">closed-world</i> setting.

Tail Time Defense Against Website Fingerprinting Attacks

In the past few years, many defense mechanisms have been proposed against website fingerprinting attacks. Walkie-Talkie (WT) built on top of the Tor network is known to be one of the most effective defense mechanisms. However, we observed that WT significantly increases the page loading time (time overhead) although the bandwidth overhead is not high. This paper analyzes the cause of the increased page loading time and presents a defending approach called Tail Time (TT), which addresses the problem by limiting the maximum time for which a pending request can block subsequent requests. Our experimental results indicate that the proposed TT defense can significantly reduce the page loading time while keeping the defense performance on par.

PF : Website Fingerprinting Attack Using Probabilistic Topic Model

Website fingerprinting (WFP) attack enables identifying the websites a user is browsing even under the protection of privacy-enhancing technologies (PETs). Previous studies demonstrate that most machine-learning attacks need multiple types of features as input, thus inducing tremendous feature engineering work. However, we show the other alternative. That is, we present Probabilistic Fingerprinting (PF), a new website fingerprinting attack that merely leverages one type of features. They are produced by using a mathematical model PWFP that combines a probabilistic topic model with WFP for the first time, due to a finding that a plain text and the sequence file generated from a traffic instance are essentially the same. Experimental results show that the proposed new features are more distinguishing than the existing features. In a closed-world setting, PF attains a better accuracy performance (99.79% at most) than prior attacks on various datasets gathered in the scenarios of Shadowsocks, SSH, and TLS, respectively. Besides, even when the number of training instances drops to as few as 4, PF still reaches an accuracy of above 90%. In the more realistic open-world setting, PF attains a high true positive rate (TPR) and Bayes detection rate (BDR), and a low false positive rate (FPR) in all evaluations, which outperforms the other attacks. These results highlight that it is meaningful and possible to explore new features to improve the accuracy of WFP attacks.

Website fingerprinting on early QUIC traffic

Cryptographic protocols have been widely used to protect the user’s privacy and avoid exposing private information. QUIC (Quick UDP Internet Connections), including the version originally designed by Google (GQUIC) and the version standardized by IETF (IQUIC), as alternatives to the traditional HTTP, demonstrate their unique transmission characteristics: based on UDP for encrypted resource transmitting, accelerating web page rendering. However, existing encrypted transmission schemes based on TCP are vulnerable to website fingerprinting (WFP) attacks, allowing adversaries to infer the users’ visited websites by eavesdropping on the transmission channel. Whether GQUIC and IQUIC can effectively resist such attacks is worth investigating. In this paper, we study the vulnerabilities of GQUIC, IQUIC, and HTTPS to WFP attacks from the perspective of traffic analysis. Extensive experiments show that, in the early traffic scenario, GQUIC is the most vulnerable to WFP attacks among GQUIC, IQUIC, and HTTPS, while IQUIC is more vulnerable than HTTPS, but the vulnerability of the three protocols is similar in the normal full traffic scenario. Features transferring analysis shows that most features are transferable between protocols when on normal full traffic scenario, which enable the adversary to use features proven effective on a special protocol efficiently attacking a new protocol. However, combining with the qualitative analysis of latent feature representation, we find that the transferring is inefficient when on early traffic, as GQUIC, IQUIC, and HTTPS show the significantly different magnitude of variation in the traffic distribution on early traffic. By upgrading the one-time WFP attacks to multiple WFP Top-a attacks, we find that the attack accuracy on GQUIC and IQUIC reach 95.4% and 95.5%, respectively, with only 40 packets and just using simple features, whereas reach only 60.7% when on HTTPS. Finally, by conducting the attacks on flawed networks, we also demonstrate that the vulnerability of IQUIC is only slightly dependent on the network environment.

Website Fingerprinting Attacks Based on Homology Analysis

Website fingerprinting attacks allow attackers to determine the websites that users are linked to, by examining the encrypted traffic between the users and the anonymous network portals. Recent research demonstrated the feasibility of website fingerprinting attacks on Tor anonymous networks with only a few samples. Thus, this paper proposes a novel small-sample website fingerprinting attack method for SSH and Shadowsocks single-agent anonymity network systems, which focuses on analyzing homology relationships between website fingerprinting. Based on the latter, we design a Convolutional Neural Network-Bidirectional Long Short-Term Memory (CNN-BiLSTM) attack classification model that achieves 94.8% and 98.1% accuracy in classifying SSH and Shadowsocks anonymous encrypted traffic, respectively, when only 20 samples per site are available. We also highlight that the CNN-BiLSTM model has significantly better migration capabilities than traditional methods, achieving over 90% accuracy when applied on a new set of monitored sites with only five samples per site. Overall, our experiments demonstrate that CNN-BiLSTM is an efficient, flexible, and robust model for website fingerprinting attack classification.

A method of fingermark anti-counterfeiting for forensic document identification

Automatic fingerprint identification is a key technology of biological attribute measurement. Due to its sensitivity to fake fingerprint attack, its security has been widely concerned. The fingermark is an important evidence for forensic documents identification. The existence of fake fingermark seriously threatens the fairness and legitimacy in the process of forensic identification. In this paper, in view of the security risks existing in the fingermark identification of forensic documents, a database named JLW-FM-DB is introduced for detecting genuine and fake fingermarks, which consists of two sub databases, signed and unsigned, each of which covers common fake fingermark materials. Based on the database, this paper proposes a method of fingermark anti-counterfeiting based on convolution neural network(CNN). A Patch-Label training strategy is proposed, which uses the unified label as the supervision signal for the class heatmap output by the last convolution layer. This strategy realizes stronger local supervision ability to input fingermark image and enhances local coding ability of CNN feature extraction. The experiments show that our methods are suitable for the detection of genuine and fake fingermarks, achieving 97.999% average accuracy in the signed fingermark database. The effectiveness of Patch-Label training strategy in fingermark anti-counterfeiting is also proved. Moreover, a model fusion of different models can further improve the detection ability of genuine and fake fingermarks, reaching to 98.496% average accuracy.

Few-Shot Website Fingerprinting Attack with Data Augmentation

This work introduces a novel data augmentation method for few-shot website fingerprinting (WF) attack where only a handful of training samples per website are available for deep learning model optimization. Moving beyond earlier WF methods relying on manually-engineered feature representations, more advanced deep learning alternatives demonstrate that learning feature representations automatically from training data is superior. Nonetheless, this advantage is subject to an unrealistic assumption that there exist many training samples per website, which otherwise will disappear. To address this, we introduce a model-agnostic, efficient, and harmonious data augmentation (HDA) method that can improve deep WF attacking methods significantly. HDA involves both intrasample and intersample data transformations that can be used in a harmonious manner to expand a tiny training dataset to an arbitrarily large collection, therefore effectively and explicitly addressing the intrinsic data scarcity problem. We conducted expensive experiments to validate our HDA for boosting state-of-the-art deep learning WF attack models in both closed-world and open-world attacking scenarios, at absence and presence of strong defense. For instance, in the more challenging and realistic evaluation scenario with WTF-PAD-based defense, our HDA method surpasses the previous state-of-the-art results by nearly 3% in classification accuracy in the 20-shot learning case. An earlier version of this work Chen et al. (2021) has been presented as preprint in ArXiv (https://arxiv.org/abs/2101.10063).

Never Query Alone: A distributed strategy to protect Internet users from DNS fingerprinting attacks

The Domain Name System (DNS) plays an essential role in everyday Internet activities. However, unauthorized access to DNS-generated traffic also poses some serious privacy concerns. For instance, DNS traffic traces can be processed by third parties to identify an Internet user by means of behavioral analysis (i.e., a technique that employs machine learning classifiers to link multiple pieces of traffic belonging to the same person). In general, the more sessions an attacker can link, the more he or she will learn about the interests of an individual, and the more likely that the identity of this user will be revealed. The development of such methods of user identification has been the focus of several pieces of research, and currently, there are several strategies to obtain behavioral fingerprints from DNS traces. However, only a few works have proposed countermeasures to protect users against this privacy threat on the Internet. Furthermore, new technologies such as DNS-over-TLS, DNS-over-HTTPS, or DNS over QUIC can potentially render available countermeasures ineffective. This paper proposes Never Query Alone (NQA), a strategy that allows a set of nodes to modify their DNS query patterns to mitigate the risk of being tracked by DNS resolvers. In NQA, users forward their DNS queries through their neighbors in such a way that the identification accuracy achieved by the attackers is proportionally reduced as the number of participant nodes is increased. A second strategy, called NQA-SA, is also proposed. NQA-SA decreases the accuracy of the attackers to nearly 1%, independently of the number of participant nodes. Both proposed countermeasures reduce the accuracy of the classifiers at the cost of increasing the delay of the DNS query resolution process. Thus, a trade-off between privacy and delay arises, which is theoretically studied in this work by means of queueing analysis. Experimental results with real networks demonstrate that the proposed countermeasures can significantly degrade the accuracy of commonly used machine learning classifiers, thus increasing the privacy protection of individuals on the Internet.

Few-shot website fingerprinting attack

Website fingerprinting (WF) attack stands opposite against privacy protection in using the Internet, even when the content details are encrypted, such as Tor networks. Whilst existing difficulty in the preparation of many training samples, we study a more realistic problem — few-shot website fingerprinting attack where only a few training samples per website are available. We introduce a novel Transfer Learning Fingerprinting Attack (TLFA) that can transfer knowledge from the labeled training data of websites disjoint and independent to the target websites. Specifically, TLFA trains a stronger embedding model with the training data collected from non-target websites, which is then leveraged in a task-agnostic manner with a task-specific classifier model fine-tuned on a small set of labeled training data from target websites. We conduct expensive experiments to validate the superiority of our TLFA over the state-of-the-art methods in both closed-world and open-world attacking scenarios, at the absence and presence of strong defense.

Deep Nearest Neighbor Website Fingerprinting Attack Technology

By website fingerprinting (WF) technologies, local listeners are enabled to track the specific website visited by users through an investigation of the encrypted traffic between the users and the Tor network entry node. The current triplet fingerprinting (TF) technique proved the possibility of small sample WF attacks. Previous research methods only concentrate on extracting the overall features of website traffic while ignoring the importance of website local fingerprinting characteristics for small sample WF attacks. Thus, in the present paper, a deep nearest neighbor website fingerprinting (DNNF) attack technology is proposed. The deep local fingerprinting features of websites are extracted via the convolutional neural network (CNN), and then the k-nearest neighbor (k-NN) classifier is utilized to classify the prediction. When the website provides only 20 samples, the accuracy can reach 96.2%. We also found that the DNNF method acts well compared to the traditional methods in coping with transfer learning and concept drift problems. In comparison to the TF method, the classification accuracy of the proposed method is improved by 2%–5% and it is only dropped by 3% when classifying the data collected from the same website after two months. These experiments revealed that the DNNF is a more flexible, efficient, and robust website fingerprinting attack technology, and the local fingerprinting features of websites are particularly important for small sample WF attacks.

RBP: a website fingerprinting obfuscation method against intelligent fingerprinting attacks

Edge computing has developed rapidly in recent years due to its advantages of low bandwidth overhead and low delay, but it also brings challenges in data security and privacy. Website fingerprinting (WF) is a passive traffic analysis attack that threatens website privacy which poses a great threat to user’s privacy and web security. It collects network packets generated while a user accesses website, and then uses a series of techniques to discover patterns of network packets to infer the type of website user accesses. Many anonymous networks such as Tor can meet the need of hide identity from users in network activities, but they are also threatened by WF attacks. In this paper, we propose a website fingerprinting obfuscation method against intelligent fingerprinting attacks, called Random Bidirectional Padding (RBP). It is a novel website fingerprinting defense technology based on time sampling and random bidirectional packets padding, which can covert the real packets distribution to destroy the Inter-Arrival Time (IAT) features in the traffic sequence and increase the difference between the datasets with random bidirectional virtual packets padding. We evaluate the defense against state-of-the-art website fingerprinting attacks in real scenarios, and show its effectiveness.