Leaked-Web: Accurate and Efficient Machine Learning-Based Website Fingerprinting Attack through Hardware Performance Counters

Abstract

Users' website browsing history contains sensitive information, like health conditions, political interests, financial situations, etc. In order to cope with the potential website behavior leakage and enhance the browsing security, some defense mechanisms such as SSH tunnels and anonymity networks (e.g., Tor) have been proposed. Nevertheless, some recent studies have demonstrated the possibility of inferring website fingerprints based on important usage information such as traffic, cache usage, memory usage, CPU activity, power consumption, and hardware performance counters information. However, existing website fingerprinting attacks demand high sampling rate which causes high performance overheads and large network traffic, and/or they require launching an additional malicious website by the user which is not guaranteed. As a result, such drawbacks make the existing attacks more noticeable to users and corresponding fingerprinting detection mechanisms. In response, in this work we propose Leaked-Web, a novel accurate and efficient machine learning-based website fingerprinting attack through processor's Hardware Performance Counters (HPCs). Leaked-Web efficiently collects hardware performance counters in users' computer system at a significantly low granularity monitoring rate and sends the samples to the remote attack's server for further classification. Leaked-Web examines the web browsers' microarchitectural features using various advanced machine learning algorithms ranging from classical, boosting, deep learning, and time-series models. Our experimental results indicate that Leaked-Web based on a LogitBoost ML classifier using only the top 4 HPC features achieves 91% classification accuracy outperforming the state-of-the-art attacks by nearly 5%. Furthermore, our proposed attack obtains a negligible performance overhead (only <1%) which is around 12% lower than the existing hardware-assisted website fingerprinting attacks.