Hidden Service Website Response Fingerprinting Attacks Based on Response Time Feature

Abstract

It has been shown that website fingerprinting attacks are capable of destroying the anonymity of the communicator at the traffic level. This enables local attackers to infer the website contents of the encrypted traffic by using packet statistics. Previous researches on hidden service attacks tend to focus on active attacks; therefore, the reliability of attack conditions and validity of test results cannot be fully verified. Hence, it is necessary to reexamine hidden service attacks from the perspective of fingerprinting attacks. In this paper, we propose a novel Website Response Fingerprinting (WRFP) Attack based on response time feature and extremely randomized tree algorithm to analyze the hidden information of the response fingerprint. The objective is to monitor hidden service website pages, service types, and mounted servers. WRFP relies on the hidden service response fingerprinting dataset. In addition to simulated website mirroring, two different mounting modes are taken into account, the same-source server and multisource server. A total of 300,000 page instances within 30,000 domain sites are collected, and we comprehensively evaluate the classification performance of the proposed WRFP. Our results show that the TPR of webpages and server classification remain greater than 93% in the small-scale closed-world performance test, and it is capable of tolerating up to 10% fluctuations in response time. WRFP also provides a higher accuracy and computational efficiency than traditional website fingerprinting classifiers in the challenging open-world performance test. This also indicates the importance of response time feature. Our results also suggest that monitoring website types improves the judgment effect of the classifier on subpages.

A Survey on Deep Learning for Website Fingerprinting Attacks and Defenses

“…Al-Naami et al webpages in the same website, they proposed to use the local request and response sequence (LRRS) as features of Internet traffic in HTTP/1.1 or HTTP/2, the raw features were slid by several different sizes of convolutional layers to generate more features in the multi-grained scanning process and the resulting features were fed into cascade forests which had a multi-layer structure, each layer consisted of the Random Forest classifiers and the Completely-Random Forest classifiers. Meng et al [87] proposed a novel Website Response Fingerprinting (WRFP) Attack based on response time feature and extremely randomized tree algorithm. Ghiette et al [88] proposed a two-stage algorithm using MinHash and locality sensitive hashing in combination with the Jaccard similarity to improve the scalability of WF attacks.…”