Efficient and Low Overhead Website Fingerprinting Attacks and Defenses based on TCP/IP Traffic
This work addresses privacy and efficiency issues in web traffic analysis for users and network operators, but it is incremental as it builds on existing attack and defense methods.
The authors tackled the problem of website fingerprinting attacks and defenses by proposing a filter-assisted attack against random packet defense and a list-assisted defense with traffic splitting to balance security and network overhead. Their experiments on real browser traffic showed effective defense accuracy and network efficiency.
Website fingerprinting attack is an extensively studied technique used in a web browser to analyze traffic patterns and thus infer confidential information about users. Several website fingerprinting attacks based on machine learning and deep learning tend to use the most typical features to achieve a satisfactory performance of attacking rate. However, these attacks suffer from several practical implementation factors, such as a skillfully pre-processing step or a clean dataset. To defend against such attacks, random packet defense (RPD) with a high cost of excessive network overhead is usually applied. In this work, we first propose a practical filter-assisted attack against RPD, which can filter out the injected noises using the statistical characteristics of TCP/IP traffic. Then, we propose a list-assisted defensive mechanism to defend the proposed attack method. To achieve a configurable trade-off between the defense and the network overhead, we further improve the list-based defense by a traffic splitting mechanism, which can combat the mentioned attacks as well as save a considerable amount of network overhead. In the experiments, we collect real-life traffic patterns using three mainstream browsers, i.e., Microsoft Edge, Google Chrome, and Mozilla Firefox, and extensive results conducted on the closed and open-world datasets show the effectiveness of the proposed algorithms in terms of defense accuracy and network efficiency.