It’s Not Just the Site, It’s the Contents: Intra-domain Fingerprinting Social Media Websites Through CDN Bursts

Wang, Kailong; Zhang, Junzhe; Bai, Guangdong; Ko, Ryan K. L.; Dong, Jin Song

doi:10.1145/3442381.3450008

Cited by 25 publications

(19 citation statements)

References 31 publications

(52 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…in the order of text, image, video and in the order of image, text, video. This phenomenon was also confirmed by the study [39] for intra-domain fingerprinting.…”

Section: Pre-training Et-bertsupporting

confidence: 74%

ET-BERT: A Contextualized Datagram Representation with Pre-training Transformers for Encrypted Traffic Classification

Lin,

Xiong,

Gou

et al. 2022

Preprint

View full text Add to dashboard Cite

Encrypted traffic classification requires discriminative and robust traffic representation captured from content-invisible and imbalanced traffic data for accurate classification, which is challenging but indispensable to achieve network security and network management. The major limitation of existing solutions is that they highly rely on the deep features, which are overly dependent on data size and hard to generalize on unseen data. How to leverage the open-domain unlabeled traffic data to learn representation with strong generalization ability remains a key challenge. In this paper, we propose a new traffic representation model called Encrypted Traffic Bidirectional Encoder Representations from Transformer (ET-BERT), which pre-trains deep contextualized datagram-level representation from large-scale unlabeled data. The pre-trained model can be fine-tuned on a small number of task-specific labeled data and achieves state-of-the-art performance across five encrypted traffic classification tasks, remarkably pushing the F1 of ISCX-VPN-Service to 98.9% (5.2%↑), Cross-Platform (Android) to 92.5% (5.4%↑), CSTNET-TLS 1.3 to 97.4% (10.0%↑). Notably, we provide explanation of the empirically powerful pre-training model by analyzing the randomness of ciphers. It gives us insights in understanding the boundary of classification ability over encrypted traffic.

show abstract

“…in the order of text, image, video and in the order of image, text, video. This phenomenon was also confirmed by the study [39] for intra-domain fingerprinting.…”

Section: Pre-training Et-bertsupporting

confidence: 74%

ET-BERT: A Contextualized Datagram Representation with Pre-training Transformers for Encrypted Traffic Classification

Lin,

Xiong,

Gou

et al. 2022

Preprint

View full text Add to dashboard Cite

show abstract

“…User traffic identification attacks are well-known, and several research works have proposed fingerprinting attacks that identify websites [33], [34], [35], [36], [37], [16], [17], [18], webpages [38], [39], videos [40], [41], [42], [43], browsers [44], [45], and even newer protocols [46] from encrypted communications. In the widely studied website fingerprinting attack, a network attacker identifies the website accessed by a user over a communication channel, with recent research works exploit algorithms from machine learning and deep learning.…”

Section: Related Workmentioning

confidence: 99%

iPET: Privacy Enhancing Traffic Perturbations for Secure IoT Communications

Shenoi¹,

Vairam²,

Sabharwal³

et al. 2022

Preprint

View full text Add to dashboard Cite

<div>IoT devices are vulnerable to different kinds of threats and attacks. The devices constantly communicate with servers over the Internet, allowing an attacker to extract sensitive information by passively monitoring the network traffic. Recent research works have shown that a network attacker with a trained machine learning (ML) model can accurately fingerprint IoT devices based on the (encrypted) traffic flows of the devices. Such fingerprinting attacks are capable of revealing the make and model of the devices, which can further be used to extract detailed user activities.</div><div><br></div><div>In this work, we develop and propose iPET, a privacy enhancing traffic perturbation technique that counters ML-based fingerprinting attacks. iPET uses adversarial deep learning, specifically, Generative Adversarial Networks (GANs), to generate these perturbations. Unlike conventional GANs, a key idea of iPET is to deliberately introduce stochasticity in the model. This approach inhibits an attacker from recreating an identical perturbation model and using it for fingerprinting. We evaluate the effectiveness of our defense against state-of-the-art fingerprinting models three different attacker capabilities. Our evaluations on synthetic and real-world datasets demonstrate that iPET decreases the accuracy of even the most powerful attacker significantly.</div>

show abstract

“…Note that the importance of information grows manifold when collected over a longer period of time [6]- [9], since it ensures sufficient coverage of users and also reflects changing trends in their behavior. Encrypted Traffic Analysis (ETA) [10]- [22] (specifically, webpage fingerprinting) is the most promising non-intrusive method to collect such information for long periods of time by merely capturing the encrypted traffic exchanged between the websites' server and the end-users. The webpages are identified by formulating signatures that can identify them uniquely when accessed by users through encrypted channels.…”

Section: Introductionmentioning

confidence: 99%

“…The webpages are identified by formulating signatures that can identify them uniquely when accessed by users through encrypted channels. While several existing webpage fingerprinting attacks [10]- [22] target particular users, our goal is to target a large number of users visiting a particular website, i.e., mass surveillance. Figure 1 shows a high-level objective of this paper.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Snoopy: A Webpage Fingerprinting Framework with Finite Query Model for Mass-Surveillance

Mitra¹,

Vairam²,

Saha³

et al. 2022

Preprint

View full text Add to dashboard Cite

Internet users are vulnerable to privacy attacks despite the use of encryption. Webpage fingerprinting, an attack that analyzes encrypted traffic, can identify the webpages visited by a user. Recent research works have been successful in demonstrating webpage fingerprinting attacks on individual users, but have been unsuccessful in extending their attack for mass-surveillance. The key challenges in performing mass-scale webpage fingerprinting arises from (i) the sheer number of combinations of user behavior and preferences to account for, and; (ii) the bound on the number of website queries imposed by the defense mechanisms (e.g., DDoS defense) deployed at the website. These constraints preclude the use of conventional data-intensive ML-based techniques.In this work, we propose Snoopy, a first-of-its-kind framework, that performs webpage fingerprinting for a large number of users visiting a website. Snoopy caters to the generalization requirements of mass-surveillance while complying with a bound on the number of website accesses (finite query model) for traffic sample collection. For this, Snoopy uses a feature (i.e., sequence of encrypted resource sizes) that is either unaffected or predictably affected by different browsing contexts (OS, browser, caching, cookie settings). Snoopy uses static analysis techniques to predict the variations caused by factors such as header sizes, MTU, and User Agent String that arise from the diversity in browsing contexts. We show that Snoopy achieves ≈ 90% accuracy when evaluated on most websites, across various browsing contexts. A simple ensemble of Snoopy and an ML-based technique achieves ≈ 97% accuracy while adhering to the finite query model, in cases when Snoopy alone does not perform well.

show abstract

It’s Not Just the Site, It’s the Contents: Intra-domain Fingerprinting Social Media Websites Through CDN Bursts

Cited by 25 publications

References 31 publications

ET-BERT: A Contextualized Datagram Representation with Pre-training Transformers for Encrypted Traffic Classification

ET-BERT: A Contextualized Datagram Representation with Pre-training Transformers for Encrypted Traffic Classification

iPET: Privacy Enhancing Traffic Perturbations for Secure IoT Communications

Snoopy: A Webpage Fingerprinting Framework with Finite Query Model for Mass-Surveillance

Contact Info

Product

Resources

About