Abstract:Several studies have shown that the network traffic that is generated by a visit to a website over Tor reveals information specific to the website through the timing and sizes of network packets. By capturing traffic traces between users and their Tor entry guard, a network eavesdropper can leverage this meta-data to reveal which website Tor users are visiting. The success of such attacks heavily depends on the particular set of traffic features that are used to construct the fingerprint. Typically, these features are manually engineered and, as such, any change introduced to the Tor network can render these carefully constructed features ineffective. In this paper, we show that an adversary can automate the feature engineering process, and thus automatically deanonymize Tor traffic by applying our novel method based on deep learning. We collect a dataset comprised of more than three million network traces, which is the largest dataset of web traffic ever used for website fingerprinting, and find that the performance achieved by our deep learning approaches is comparable to known methods which include various research efforts spanning over multiple years. The obtained success rate exceeds 96% for a closed world of 100 websites and 94% for our biggest closed world of 900 classes. In our open world evaluation, the most performant deep learning model is 2% more accurate than the state-of-the-art attack. Furthermore, we show that the implicit features automatically learned by our approach are far more resilient to dynamic changes of web content over time. We conclude that the ability to automatically construct the most relevant traffic features and perform accurate traffic recognition makes our deep learning based approach an efficient, flexible and robust technique for website fingerprinting.

DarkHunter: A Fingerprint Recognition Model for Web Automated Scanners Based on CNN

Res-DFNN: an NN-Based Device Fingerprint Extraction Method Using Network Packet Data

p-FP: Extraction, Classification, and Prediction of Website Fingerprints with Deep Learning

Automated Diatom Searching in the Digital Scanning Electron Microscopy Images of Drowning Cases Using the Deep Neural Networks

Forensic Scanner Identification Using Machine Learning

DeepFPD: Browser Fingerprinting Detection via Deep Learning With Multimodal Learning and Attention

A Secure Fingerprinting Framework for Distributed Image Classification

A Practical Website Fingerprinting Attack via CNN-Based Transfer Learning

Detecting Malicious Web Requests Using an Enhanced TextCNN.

Scanner-Hunter: An Effective ICS Scanning Group Identification System

An Automated Multi-Tab Website Fingerprinting Attack

A Deep Learning Framework for Image Authentication: An Automatic Source Camera Identification Deep-Net

Detecting Coordinated Internet-Wide Scanning by TCP/IP Header Fingerprint

CPWF: Cross-Platform Website Fingerprinting Based on Multi-Similarity Loss

DarknetSec: A novel self-attentive deep learning method for darknet traffic classification and application identification

Hunter in the Dark: Discover Anomalous Network Activity Using Deep Ensemble Network

Automated Website Fingerprinting through Deep Learning

An IoT Device Identification Method Using Extracted Fingerprint From Sequence of Traffic Grayscale Images

Counterfeit Fingerprint Detection of Outbound HTTP Traffic with Graph Edit Distance

BotDetector: a System for Identifying DGA-based Botnet with CNN-LSTM

Deep Learning Algorithm for Threat Detection in Hackers Forum (Deep Web)