Breaking the Closed-World Assumption in Stylometric Authorship Attribution

Stolerman, Ariel; Overdorf, Rebekah; Afroz, Sadia; Greenstadt, Rachel

doi:10.1007/978-3-662-44952-3_13

Cited by 25 publications

(29 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This is a form of Abstaining classification [5]. In this paper, we use the modified "Classify-Verify" approach as discussed by Stolerman et al [27].…”

Section: Classify-verifymentioning

confidence: 99%

See 1 more Smart Citation

A Critical Evaluation of Website Fingerprinting Attacks

Juárez

Afroz

Acar

et al. 2014

Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security

Self Cite

238

219

View full text Add to dashboard Cite

Recent studies on Website Fingerprinting (WF) claim to have found highly effective attacks on Tor. However, these studies make assumptions about user settings, adversary capabilities, and the nature of the Web that do not necessarily hold in practical scenarios. The following study critically evaluates these assumptions by conducting the attack where the assumptions do not hold. We show that certain variables, for example, user's browsing habits, differences in location and version of Tor Browser Bundle, that are usually omitted from the current WF model have a significant impact on the efficacy of the attack. We also empirically show how prior work succumbs to the base rate fallacy in the open-world scenario. We address this problem by augmenting our classification method with a verification step. We conclude that even though this approach reduces the number of false positives over 63%, it does not completely solve the problem, which remains an open issue for WF attacks.

show abstract

“…This is a form of Abstaining classification [5]. In this paper, we use the modified "Classify-Verify" approach as discussed by Stolerman et al [27].…”

Section: Classify-verifymentioning

confidence: 99%

“…If the verification score of D is less than the determined threshold, the classifier's output will be rejected. Unlike Stolerman et al [27], we maximize F β instead of F 1 to choose threshold by adjusting weights for precision and recall. β ≤ 0.5 achieves fewer false positives at the cost of true positives than β > 0.5. attacks.…”

Section: Classify-verifymentioning

confidence: 99%

A Critical Evaluation of Website Fingerprinting Attacks

Juárez

Afroz

Acar

et al. 2014

Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security

Self Cite

238

219

View full text Add to dashboard Cite

show abstract

“…The distributed nature of cyber space provides an ideal anonymous channel for computer-mediated malicious activities, e.g., phishing scams, spamming, ransom messages, harassment, money laundering, illegal material distribution, etc., because the network-based origins such as IP address can be easily repudiated. Several authorship identification techniques have been developed for the purpose of cyber investigation on SMS text-messaging slips [Ragel et al 2014], personal e-mails [Iqbal et al 2013;Ding et al 2015], and social blogs [Yang and Chow 2014;Stolerman et al 2014]. Stylometric techniques have been used as evidence in the form of expert knowledge in the courts of the UK, the US, and Australia [Juola 2006;Brennan et al 2012].…”

Section: Introductionmentioning

confidence: 99%

Learning Stylometric Representations for Authorship Analysis

Ding

Fung

Iqbal

et al. 2019

IEEE Trans. Cybern.

View full text Add to dashboard Cite

Authorship analysis (AA) is the study of unveiling the hidden properties of authors from a body of exponentially exploding textual data. It extracts an author's identity and sociolinguistic characteristics based on the reflected writing styles in the text. It is an essential process for various areas, such as cybercrime investigation, psycholinguistics, political socialization, etc. However, most of the previous techniques critically depend on the manual feature engineering process. Consequently, the choice of feature set has been shown to be scenario-or dataset-dependent. In this paper, to mimic the human sentence composition process using a neural network approach, we propose to incorporate different categories of linguistic features into distributed representation of words in order to learn simultaneously the writing style representations based on unlabeled texts for authorship analysis. In particular, the proposed models allow topical, lexical, syntactical, and character-level feature vectors of each document to be extracted as stylometrics. We evaluate the performance of our approach on the problems of authorship characterization and authorship verification with the Twitter, novel, and essay datasets. The experiments suggest that our proposed text representation outperforms the bag-of-lexical-n-grams, Latent Dirichlet Allocation, Latent Semantic Analysis, PVDM, PVDBOW, and word2vec representations.

show abstract

“…To decide whether a target trace is monitored or unmonitored, we use a method proposed by Stolerman et al [60]. We assign the target trace to the monitored class if and only if the classifier predicts this class with probability larger than a threshold t, and to unmonitored otherwise.…”

Section: Evaluating N-grams Featuresmentioning

confidence: 99%

Encrypted DNS --> Privacy? A Traffic Analysis Perspective

Siby

Juárez

Díaz

et al. 2020

Proceedings 2020 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

Virtually every connection to an Internet service is preceded by a DNS lookup. These lookups are performed in the clear without integrity protection, enabling manipulation, redirection, surveillance, and censorship. In parallel with standardization efforts that address these issues, large providers such as Google and Cloudflare are deploying solutions to encrypt lookups, such as DNS-over-TLS (DoT) and DNS-over-HTTPS (DoH). In this paper we examine whether encrypting DoH traffic can protect users from traffic analysis-based monitoring and censoring. We find that performing traffic analysis on DoH traces requires different features than those used to attack HTTPS or Tor traffic. We propose a new feature set tailored to the characteristics of DoH traffic. Our classifiers obtain an F1-score of 0.9 and 0.7 in closed and open world settings, respectively. We show that although factors such as location, resolver, platform, or client affect performance, they are far from completely deterring the attacks. We then study deployed countermeasures and show that, in contrast with web traffic, Tor effectively protects users. Specified defenses, however, still preserve patterns and leave some webs unprotected. Finally, we show that web censorship is still possible by analysing DoH traffic and discuss how to selectively block content with low collateral damage.

show abstract

Breaking the Closed-World Assumption in Stylometric Authorship Attribution

Cited by 25 publications

References 20 publications

A Critical Evaluation of Website Fingerprinting Attacks

A Critical Evaluation of Website Fingerprinting Attacks

Learning Stylometric Representations for Authorship Analysis

Encrypted DNS --> Privacy? A Traffic Analysis Perspective

Contact Info

Product

Resources

About