Website Fingerprinting with Website Oracles
Website Fingerprinting with Website Oracles
复制标题
使用网站预言机进行网站指纹识别
DOI：
--
复制
发表时间：
2020
影响因子：
--
通讯作者：
Rasmus Dahlberg
中科院分区：
文献类型：
--
作者：
T. Pulls;Rasmus Dahlberg
网站指纹（WF）攻击是流量分析攻击的一个子集，其中本地被动攻击者试图推断目标受害者通过加密隧道（如匿名网络Tor）访问哪些网站。我们介绍了网站Oracle （WO）的安全概念，它使WF攻击者能够确定在受害者跟踪时Tor客户端访问的网站中是否有特定的受监控网站。我们的模拟表明，将WO与WF攻击（我们称之为WF+WO攻击）相结合，可以显著减少大约一半的网站访问和绝大多数通过Tor访问的网站的误报。对于Alexa排名在10000左右的网站，测得的假阳性率大约是每100万个分类网站追踪中有一个假阳性。不太受欢迎的受监测网站显示出低几个数量级的假阳性率。我们认为，WOs是匿名网络设置所固有的，并且在评估WF攻击和防御时应该是攻击者的假设能力。由于使用了DNS、OCSP和互联网上的在线广告实时竞价，以及大量的中间件和访问日志，因此，WOs的来源非常丰富，可供各种现实攻击者使用。对WO的访问表明，在开放世界中对WF防御的评估应该集中在攻击者可以实现的最高召回上。我们的模拟表明，Sirinam等人通过访问WO来增强深度指纹WF攻击，可以显著提高对五种最先进的WF防御的攻击，使其中一些在新的WF+WO设置中基本无效。
Abstract Website Fingerprinting (WF) attacks are a subset of traffic analysis attacks where a local passive attacker attempts to infer which websites a target victim is visiting over an encrypted tunnel, such as the anonymity network Tor. We introduce the security notion of a Website Oracle (WO) that gives a WF attacker the capability to determine whether a particular monitored website was among the websites visited by Tor clients at the time of a victim’s trace. Our simulations show that combining a WO with a WF attack—which we refer to as a WF+WO attack—significantly reduces false positives for about half of all website visits and for the vast majority of websites visited over Tor. The measured false positive rate is on the order one false positive per million classified website trace for websites around Alexa rank 10,000. Less popular monitored websites show orders of magnitude lower false positive rates. We argue that WOs are inherent to the setting of anonymity networks and should be an assumed capability of attackers when assessing WF attacks and defenses. Sources of WOs are abundant and available to a wide range of realistic attackers, e.g., due to the use of DNS, OCSP, and real-time bidding for online advertisement on the Internet, as well as the abundance of middleboxes and access logs. Access to a WO indicates that the evaluation of WF defenses in the open world should focus on the highest possible recall an attacker can achieve. Our simulations show that augmenting the Deep Fingerprinting WF attack by Sirinam et al. [60] with access to a WO significantly improves the attack against five state-of-the-art WF defenses, rendering some of them largely ineffective in this new WF+WO setting.
DOI：
10.1109/wnyipw.2018.8576379
发表时间：
2018
期刊：
Proceedings of the 2018 IEEE Western New York Image and Signal Processing Workshop
影响因子：
--
作者：
Mathews, Nate;Sirinam, Payap;Wright, Matthew
通讯作者：
Wright, Matthew