Abstract:Website Fingerprinting (WF) attacks identify the websites visited by users by performing traffic analysis, compromising user privacy. Particularly, DL-based WF attacks demonstrate impressive attack performance. However, the effectiveness of DL-based WF attacks relies on the collected complete and pure traffic during the page loading, which impacts the practicality of these attacks. The WF performance is rather low under dynamic network conditions and various WF defenses, particularly when the analyzed traffic is only a small part of the complete traffic. In this paper, we propose Holmes, a robust and reliable early-stage WF attack. Holmes utilizes temporal and spatial distribution analysis of website traffic to effectively identify websites in the early stages of page loading. Specifically, Holmes develops adaptive data augmentation based on the temporal distribution of website traffic and utilizes a supervised contrastive learning method to extract the correlations between the early-stage traffic and the pre-collected complete traffic. Holmes accurately identifies traffic in the early stages of page loading by computing the correlation of the traffic with the spatial distribution information, which ensures robust and reliable detection according to early-stage traffic. We extensively evaluate Holmes using six datasets. Compared to nine existing DL-based WF attacks, Holmes improves the F1-score of identifying early-stage traffic by an average of 169.18%. Furthermore, we replay the traffic of visiting real-world dark web websites. Holmes successfully identifies dark web websites when the ratio of page loading on average is only 21.71%, with an average precision improvement of 169.36% over the existing WF attacks.

Light-weight detection of HTTP attacks for large-scale Web sites

Low-rate DoS Attack Detection Method Based on Hybrid Deep Neural Networks.

Group Testing Based Detection of Web Service DDoS Attackers.

Website Detection Using Remote Traffic Analysis

Detecting Randomly Scanning Worms Based on Heavy-Tailed Property

HTTPSmell: A Deep Learning Approach on Malicious HTTP Traffic Detection via Data Augmentation and Label Refactoring

: Towards Fine-Grained Unknown Class Detection Against the Open-Set Attack Spectrum with Variable Legitimate Traffic

A New Multistage Approach to Detect Subtle DDoS Attacks.

Detecting a Variety of Long-Term Stealthy User Behaviors on High Speed Links

DeepHTTP: Semantics-Structure Model with Attention for Anomalous HTTP Traffic Detection and Pattern Mining

A Lightweight Ddos Flooding Attack Detection Algorithm Based On Synchronous Long Flows

Light-weight Detection Method Against SYN Flooding Attacks

Robust and Reliable Early-Stage Website Fingerprinting Attacks via Spatial-Temporal Distribution Analysis

An Evasion and Counter-Evasion Study in Malicious Websites Detection

Router based detection for low-rate agents of DDoS attack

An Automated Multi-Tab Website Fingerprinting Attack

A Hypothesis Testing Based Scalable TCP Scan Detection.

Attacking Websites: Detecting and Preventing HTTP Request Smuggling Attacks

High-speed anomaly traffic detection based on staged frequency domain features

Anomaly-Based Web Attack Detection: A Deep Learning Approach

Simulation for L3 Volumetric Attack Detection