Revisiting Assumptions for Website Fingerprinting Attacks
Revisiting Assumptions for Website Fingerprinting Attacks
复制标题
DOI：
10.1145/3321705.3329802
复制
发表时间：
2019-07
期刊：
影响因子：
--
通讯作者：
Weiqi Cui;Tao Chen;C. Fields;Julian Chen;Anthony Sierra;Eric Chan-Tin
中科院分区：
文献类型：
--
作者：
Weiqi Cui;Tao Chen;C. Fields;Julian Chen;Anthony Sierra;Eric Chan-Tin
大多数有隐私意识的用户使用HTTPS和匿名网络（如Tor）来屏蔽源和目的IP地址。已经表明，加密和匿名的网络流量跟踪仍然可以通过一种称为网站指纹（WF）攻击的攻击类型泄漏信息。攻击者记录网络流量，只能观察传入和传出消息的数量、每条消息的大小以及消息之间的时间差。在以前的工作中，当使用Tor作为匿名网络时，网站指纹识别的有效性已被证明具有超过90%的准确性。因此，互联网服务提供商可以成功地识别其用户正在访问的网站。关于网站指纹的一个主要问题是它的实用性。在大多数以前的工作的共同假设是，受害者是访问一个网站在同一时间，并有机会获得该网站的完整的网络跟踪。然而，这是不现实的。我们提出了两个新的算法来处理的情况下，受害者访问一个网站后，另一个（连续访问），并访问另一个网站在访问一个网站（重叠访问）。我们表明，我们的算法在寻找分裂点（这是跟踪中第二个网站的起点）时的准确度为80（与以前的工作[24]中的63相比）。使用我们提出的“分裂”算法，网站可以预测的准确率为70%。当两个网站的访问是重叠的，网站指纹的准确性显着下降福尔斯。使用我们提出的“分段”算法，预测重叠访问的网站的准确率从22.80%提高到70%。当部分网络轨迹丢失时（无论是开始还是结束），使用我们的切片算法时，准确率从20%增加到60%以上。
Most privacy-conscious users utilize HTTPS and an anonymity network such as Tor to mask source and destination IP addresses. It has been shown that encrypted and anonymized network traffic traces can still leak information through a type of attack called a website fingerprinting (WF) attack. The adversary records the network traffic and is only able to observe the number of incoming and outgoing messages, the size of each message, and the time difference between messages. In previous work, the effectiveness of website fingerprinting has been shown to have an accuracy of over 90% when using Tor as the anonymity network. Thus, an Internet Service Provider can successfully identify the websites its users are visiting. One main concern about website fingerprinting is its practicality. The common assumption in most previous work is that a victim is visiting one website at a time and has access to the complete network trace of that website. However, this is not realistic. We propose two new algorithms to deal with situations when the victim visits one website after another (continuous visits) and visits another website in the middle of visiting one website (overlapping visits). We show that our algorithm gives an accuracy of 80 (compared to 63 in a previous work [24]) in finding the split point which is the start point for the second website in a trace. Using our proposed "splitting" algorithm, websites can be predicted with an accuracy of 70%. When two website visits are overlapping, the website fingerprinting accuracy falls dramatically. Using our proposed "sectioning'' algorithm, the accuracy for predicting the website in overlapping visits improves from 22.80% to 70%. When part of the network trace is missing (either the beginning or the end), the accuracy when using our sectioning algorithm increases from 20 to over 60%.