A Multi-tab Website Fingerprinting Attack

Xu, Yixiao; Wang, Tao; Li, Qi; Gong, Qingyuan; Yang, Chen; Jiang, Yong

doi:10.1145/3274694.3274697

Cited by 45 publications

(23 citation statements)

References 18 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Along with feature extraction, localization and classification of all full monitored traces are jointly optimized in a single deep learning architecture, i.e., end-to-end. This is drastically different from and more elegant than all the previous WFA methods [17,18] that model the localization (i.e., trace splitting) and classification independently and hence suffer from the notorious localization error propagation problem. As a consequence, their methods are poor in tackling the realistic WFA situations (see Table 1).…”

Section: Concretely We Redefine the Problem Of Mt-wfa As Followsmentioning

confidence: 85%

“…In the literature, there are a limited number of works [11,[16][17][18] that study the MT-WFA problem at varying degrees.…”

Section: Multi-tab Wf Attackmentioning

confidence: 99%

“…In the literature there are only very few studies on MT-WFA [11,[16][17][18]. Importantly, they are highly limited in different aspects, and none of them investigate fully the realworld user behaviors and all the native challenges with MT-WFA.…”

Section: Introductionmentioning

confidence: 99%

“…Wang et al [11] moved a step further by studying how to split Tor's two-tab traces so that the MT-WFA problem can be solved by previous ST-WFA models. Later on, Xu et al [17] improved the splitting of two-tab traces but limited to only classifying the clean front segment of the first website fingerprinting. More recently, Gong et al [18] considers a simplified MT-WFA setting without overlapping between website fingerprinting in a defense perspective.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

End-to-End Multi-Tab Website Fingerprinting Attack: A Detection Perspective

Chen¹,

Chen²,

Wang³

et al. 2022

Preprint

View full text Add to dashboard Cite

Website fingerprinting attack (WFA) aims to deanonymize the website a user is visiting through anonymous networks channels (e.g., Tor). Despite of remarkable progress in the past years, most existing methods make implicitly a couple of artificial assumptions that (1) only a single website (i.e., single-tab) is visited each time, and (2) website fingerprinting data are pre-trimmed into a single trace per website manually. In reality, a user often open multiple tabs for multiple websites spontaneously. Indeed, this multi-tab WFA (MT-WFA) setting has been studied in a few recent works, but all of them still fail to fully respect the real-world situations. In particular, the overlapping challenge between website fingerprinting has never been investigated in depth. In this work, we redefine the problem of MT-WFA as detecting multiple monitored traces, given a natural untrimmed traffic data including monitored traces, unmonitored traces, and potentially unconstrained overlapping between them. This eliminates the above assumptions, going beyond the conventional single website fingerprint classification perspective taken by all previous WFA methods. To tackle this realistic MT-WFA problem, we formulate a novel Website Fingerprint Detection (WFD) model capable of detecting accurately the start and end points of all the monitored traces and classifying them jointly, given long, untrimmed raw traffic data. WFD is end-to-end, with the trace localization and website classification integrated in a single unified pipeline. To enable quantitative evaluation in our MT-WFA setting, we introduce new performance metrics. Extensive experiments on several newly constructed benchmarks show that our WFD outperforms the state-of-the-art alternative methods in both accuracy and efficiency by a large margin, even with a very small training set. Code is available at https://github.com/WFDetector/WFDetection.

show abstract

Section: Concretely We Redefine the Problem Of Mt-wfa As Followsmentioning

confidence: 85%

“…In the literature, there are a limited number of works [11,[16][17][18] that study the MT-WFA problem at varying degrees.…”

Section: Multi-tab Wf Attackmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

End-to-End Multi-Tab Website Fingerprinting Attack: A Detection Perspective

Chen¹,

Chen²,

Wang³

et al. 2022

Preprint

View full text Add to dashboard Cite

show abstract

“…There is also a time gap when changing from one tab to another to open or reload a different website, especially for users with a single screen. All these together allow an observer to distinguish between individual website visits, as also evident by existing techniques that can be employed to split a network trace of such multi-tab activity into individual traces [23,24,111]. Moreover, although many individual users may be located behind the same NAT network, Verde et al [105] have developed a framework that can identify different individuals behind a large metropolitan WiFi network based on NetFlow records.…”

Section: Threat Modelmentioning

confidence: 99%

Domain name encryption is not enough: privacy leakage via IP-based website fingerprinting

Hoang

Niaki

Gill

et al. 2021

Proceedings on Privacy Enhancing Technologies

View full text Add to dashboard Cite

Although the security benefits of domain name encryption technologies such as DNS over TLS (DoT), DNS over HTTPS (DoH), and Encrypted Client Hello (ECH) are clear, their positive impact on user privacy is weakened by—the still exposed—IP address information. However, content delivery networks, DNS-based load balancing, co-hosting of different websites on the same server, and IP address churn, all contribute towards making domain–IP mappings unstable, and prevent straightforward IP-based browsing tracking. In this paper, we show that this instability is not a roadblock (assuming a universal DoT/DoH and ECH deployment), by introducing an IP-based website finger-printing technique that allows a network-level observer to identify at scale the website a user visits. Our technique exploits the complex structure of most websites, which load resources from several domains besides their primary one. Using the generated fingerprints of more than 200K websites studied, we could successfully identify 84% of them when observing solely destination IP addresses. The accuracy rate increases to 92% for popular websites, and 95% for popular and sensitive web-sites. We also evaluated the robustness of the generated fingerprints over time, and demonstrate that they are still effective at successfully identifying about 70% of the tested websites after two months. We conclude by discussing strategies for website owners and hosting providers towards hindering IP-based website fingerprinting and maximizing the privacy benefits offered by DoT/DoH and ECH.

show abstract