基于侧信道分析的Web站点指纹识别技术研究

匿名通信系统的广泛应用对网络监管造成了严峻挑战，而现有匿名Web流量分析技术在实用性方面存在诸多限制，研究提高其可用性具有重要现实意义。本项目拟基于侧信道分析，在大规模无特定目标、面向特定目标以及多页面流量混杂三种场景下，研究Web站点指纹识别方法，分别解决可扩展性、识别效果和适用性三方面的问题。提出基于持续学习的指纹识别方法，通过改进深度残差网络进行样本表征学习，并引入蒸馏损失实现类别增量更新，以提高可扩展性；设计基于强化学习的报文主动调制方案以获得更为清晰的流量特征，解决被动流量分析时特征模糊、易抖动的问题，进一步提高准确率；在存在背景流量情况下研究多页面匿名交叠流量解构方案，并设计基于局部序列匹配的片段化指纹识别方法，突破现有攻击模型局限性。在理论成果基础上开发可实际部署的指纹识别工具集。通过本项目的研究，将提升Web站点指纹攻击技术在实际场景中的可用性，为匿名流量监管提供技术支撑。

The widespread use of anonymous communication systems poses severe challenges to network supervision. However, the existing anonymous Web traffic analysis technologies have many limitations which restrict the practicability. Therefore, it is of great practical significance to improve its usability. This project intends to analyze the theory and method of website fingerprinting attack based on the side channel analysis technology under three practical scenarios of large-scale non-target, target-oriented and multi-tab, aiming at improving the scalability, accuracy and applicability respectively. We propose a novel website fingerprinting attack through lifelong learning, and design a sample representation learning method based on deep residual network. The distillation loss function is introduced to preserves knowledge of the original model, which improve the scalability while realizing class-incremental learning. Considering that the values of selected features are blur and prone to jitter in the passive attack model, an active website fingerprinting attack is studied to obtain clearer features and higher accuracy by modulating the request packets. To optimize the packet modulation, we generate the packet modulation scheme based on reinforcement learning. Furthermore, as for the solution of the poor applicability caused by severe assumptions, a website fingerprinting attack against multi-tab browsing behavior is proposed. To filter the background traffic, we design a decomposition method for anonymous overlapped traffic. Then we identify the segmented fingerprints based on local sequence matching. Finally, a set of website fingerprinting identification tools that can be practically deployed is developed. This project is able to improve the practicality of the website fingerprinting attack in the actual surveillance scenarios, which is expected to provide technical support for the surveillance of anonymous communication traffic.