WebTracker: Real Webbrowsing Behaviors
WebTracker: Real Webbrowsing Behaviors
复制标题
DOI：
10.1109/svcc56964.2023.10164930
复制
发表时间：
2023-05
期刊：
影响因子：
--
通讯作者：
Daisy Reyes;Eno Dynowski;T. Chovan;John Mikos;Eric Chan-Tin;Mohammed Abuhamad;S. Kennison
中科院分区：
文献类型：
--
作者：
Daisy Reyes;Eno Dynowski;T. Chovan;John Mikos;Eric Chan-Tin;Mohammed Abuhamad;S. Kennison
随着隐私问题的增加，VPN和Tor等匿名工具变得越来越受欢迎。然而，诸如分组大小和分组数量的分组元数据仍然可以被对手观察到。这通常被称为指纹和网站指纹攻击最近受到了很多关注，因为已知受害者的网站访问可以准确预测，使受害者的网络使用去匿名化。以前的大部分工作都是在实验室环境中进行的，并做了两个假设：1）受害者一次访问一个网站，2）可以观察到所有网络数据包的整个网站访问。为了验证这些假设，我们为真实的用户部署了一个名为“网络搜寻家”的新的专用网络浏览器扩展。“网络搜寻家”记录访问过的网站、网站加载开始的时间以及网站加载完成的时间。结果表明，用户的浏览模式是不同的，比以前假设的。由于多个网站同时重叠和下载，用户可以以作为对抗网站指纹的对策的方式浏览网页。超过15%的网站与至少一个其他网站重叠，每次重叠时间为66秒。此外，每次重叠发生在第一次网站下载开始后大约9秒。因此，这加强了以前的一些工作，即网站的开始比网站指纹攻击的结束更重要。
With increased privacy concerns, anonymity tools such as VPNs and Tor have become popular. However, the packet metadata such as the packet size and number of packets can still be observed by an adversary. This is commonly known as fingerprinting and website fingerprinting attacks have received a lot of attention recently as a known victim’s website visits can be accurately predicted, deanonymizing that victim’s web usage. Most of the previous work have been performed in laboratory settings and have made two assumptions: 1) a victim visits one website at a time, and 2) the whole website visit with all the network packets can be observed. To validate these assumptions, a new private webbrowser extension called WebTracker is deployed with real users. WebTracker records the websites visited, when the website loading starts, and when the website loading finishes. Results show that users’ browsing patterns are different than what was previously assumed. Users may browse the web in a way that acts as a countermeasure against website fingerprinting due to multiple websites overlapping and downloading at the same time. Over 15% of websites overlap with at least one other website and each overlap was 66 seconds. Moreover, each overlap happens roughly 9 seconds after the first website download has started. Thus, this reinforces some previous work that the beginning of a website is more important than the end for a website fingerprinting attack.