Website Fingerprinting in the Age of QUIC
Website Fingerprinting in the Age of QUIC
复制标题
DOI：
10.2478/popets-2021-0017
复制
发表时间：
2021-01
影响因子：
--
通讯作者：
Jean-Pierre Smith;Prateek Mittal;A. Perrig
中科院分区：
文献类型：
--
作者：
Jean-Pierre Smith;Prateek Mittal;A. Perrig
随着QUIC协议的迅速崛起，TCP作为Web流量底层事实上的传输协议的霸主地位将很快消失。HTTP/3是HTTP协议的下一个版本，将不支持TCP。当前的网站指纹文献忽略了将这种新协议引入所有现代浏览器。在这项工作中，我们研究了在TCP设置中训练的分类器是否可以推广到QUIC痕迹，QUIC是否天生比TCP更难指纹识别，这些协议之间的特征重要性如何变化，以及如何联合分类QUIC和TCP痕迹。使用四个最先进的网站指纹识别分类器和我们的组合QUIC-TCP数据集（约117，000个痕迹）进行的实验表明，虽然QUIC并不比TCP更难识别，但TCP训练的分类器可能无法检测到高达96%的QUIC访问监控URL。此外，利用同一URL的QUIC和TCP跟踪之间的公共信息的分类器在有限的数据设置中可能优于特定于协议的分类器的集合。
Abstract With the meteoric rise of the QUIC protocol, the supremacy of TCP as the de facto transport protocol underlying web traffic will soon cease. HTTP/3, the next version of the HTTP protocol, will not support TCP. Current website-fingerprinting literature has ignored the introduction of this new protocol to all modern browsers. In this work, we investigate whether classifiers trained in the TCP setting generalise to QUIC traces, whether QUIC is inherently more difficult to fingerprint than TCP, how feature importance changes between these protocols, and how to jointly classify QUIC and TCP traces. Experiments using four state-of-theart website-fingerprinting classifiers and our combined QUIC-TCP dataset of ~117,000 traces show that while QUIC is not inherently more difficult to fingerprint than TCP, TCP-trained classifiers may fail to detect up to 96% of QUIC visits to monitored URLs. Furthermore, classifiers that take advantage of the common information between QUIC and TCP traces for the same URL may outperform ensembles of protocol-specific classifiers in limited data settings.