Abstract:Website fingerprinting (WF) attacks identify the websites visited over anonymized connections by analyzing patterns in network traffic flows, such as packet sizes, directions, or interval times using a machine learning classifier. Previous studies showed WF attacks achieve high classification accuracy. However, several issues call into question whether existing WF approaches are realizable in practice and thus motivate a re-exploration. Due to Tor's performance issues and resulting poor browsing experience, the vast majority of users opt for Virtual Private Networking (VPN) despite VPNs weaker privacy protections. Many other past assumptions are increasingly unrealistic as web technology advances. Our work addresses several key limitations of prior art. First, we introduce a new approach that classifies entire websites rather than individual web pages. Site-level classification uses traffic from all site components, including advertisements, multimedia, and single-page applications. Second, our Convolutional Neural Network (CNN) uses only the jitter and size of 500 contiguous packets from any point in a TCP stream, in contrast to prior work requiring heuristics to find page boundaries. Our seamless approach makes eavesdropper attack models realistic. Using traces from a controlled browser, we show our CNN matches observed traffic to a website with over 90% accuracy. We found the training traffic quality is critical as classification accuracy is significantly reduced when the training data lacks variability in network location, performance, and clients' computational capability. We enhanced the base CNN's efficacy using domain adaptation, allowing it to discount irrelevant features, such as network location. Lastly, we evaluate several defensive strategies against seamless WF attacks.

Genuine onion: Simple, Fast, Flexible, and Cheap Website Authentication

How Do Tor Users Interact With Onion Services?

How Unique is Your .onion? An Analysis of the Fingerprintability of Tor Onion Services

Attacks on Onion Discovery and Remedies via Self-Authenticating Traditional Addresses

Hiding in text/plain sight: Security defences of Tor Onion Services

Protecting Onion Service Users Against Phishing

Updated exploration of the Tor network: advertising, availability and protocols of onion services

Guardians of Anonymity: Exploring Tactics to Combat Cyber Threats in Onion Routing Environments

Leakage of .onion at the DNS Root

OnionBots: Subverting Privacy Infrastructure for Cyber Attacks

Onions in the Crosshairs: When The Man really is out to get you

Cutting Onions With Others' Hands: A First Measurement of Tor Proxies in the Wild.

Onionchain: Towards Balancing Privacy and Traceability of Blockchain-Based Applications

"Super nodes" in Tor: existence and security implication

Link Us if You Can: Enabling Unlinkable Communication on the Internet

FedTor: an Anonymous Framework of Federated Learning in Internet of Things

Seamless Website Fingerprinting in Multiple Environments

Tor circuit fingerprinting defenses using adaptive padding

SMART: A Lightweight and Reliable Multi-Path Transmission Model against Website Fingerprinting Attacks

DarkDiff: Explainable web page similarity of TOR onion sites

ONION: A Simple and Effective Defense Against Textual Backdoor Attacks