PF : Website Fingerprinting Attack Using Probabilistic Topic Model

Abstract

Website fingerprinting (WFP) attack enables identifying the websites a user is browsing even under the protection of privacy-enhancing technologies (PETs). Previous studies demonstrate that most machine-learning attacks need multiple types of features as input, thus inducing tremendous feature engineering work. However, we show the other alternative. That is, we present Probabilistic Fingerprinting (PF), a new website fingerprinting attack that merely leverages one type of features. They are produced by using a mathematical model PWFP that combines a probabilistic topic model with WFP for the first time, due to a finding that a plain text and the sequence file generated from a traffic instance are essentially the same. Experimental results show that the proposed new features are more distinguishing than the existing features. In a closed-world setting, PF attains a better accuracy performance (99.79% at most) than prior attacks on various datasets gathered in the scenarios of Shadowsocks, SSH, and TLS, respectively. Besides, even when the number of training instances drops to as few as 4, PF still reaches an accuracy of above 90%. In the more realistic open-world setting, PF attains a high true positive rate (TPR) and Bayes detection rate (BDR), and a low false positive rate (FPR) in all evaluations, which outperforms the other attacks. These results highlight that it is meaningful and possible to explore new features to improve the accuracy of WFP attacks.

A Survey on Deep Learning for Website Fingerprinting Attacks and Defenses

“…Li et al [97] constructed a resource loading tree (RLTree) to represent a website, based on the multiple initial TCP sessions generated by visiting the website, and proposed a novel WF attack based on RLTree similarity. Hongcheng Zou et al [98] presented Probabilistic Fingerprinting (PF), a new WF attack based on kNN, using topic probability vectors of traffic instances as features. Kexin Zou et al [99] proposed a novel lightweight WF attack on Bitcoin hidden service, using a random decision forest classifier with features from TLS packet size and direction.…”