SaTC: CORE: Small: Adversarial ML in Traffic Analysis

互联网上的监视和跟踪越来越普遍，威胁到隐私和言论自由。Tor匿名系统保护了数百万用户的隐私，包括普通公民、记者、举报人、军事情报机构、警察、企业以及生活在审查和监视之下的人们。不幸的是，Tor很容易受到网站指纹（WF）攻击，在这种攻击中，窃听者使用机器学习（ML）分类器从其流量模式中识别用户正在访问的网站。研究团队使用深度学习分类器进行的最先进的WF攻击准确率达到98%，这对Tor及其用户来说是非常重要的。这个项目的目标是根据团队在深度学习方面的发现，探索WF攻击和防御的新领域。这项工作的一个关键方面是建立在愚弄深度学习分类器的最新进展基础上，并将这些新发现应用于匿名系统的背景下。基于对对抗性机器学习的关注，该项目将创建一个关于该主题的新课程和一个可访问的夏令营模块，并推出一个关于网络安全研究的播客，其中包括对抗性机器学习和匿名领域的顶级研究人员的采访。这项研究有三个重点。首先，该团队正在探索这些攻击对Tor用户的影响，通过解决攻击如何可以推广到不同的网络条件和Tor版本，如何更好地适应现实环境，以及它们如何受到Tor中真实用户行为的影响。其次，由于最近的工作表明有可能可靠地欺骗深度学习分类器，该团队正在研究如何使这些技术适应强大而有效的防御。先前的工作主要是在图像分类领域，而网络流量的操作更具挑战性，因此该团队正在设计新的方法来解释这种差异。在第三个推力中，认识到研究人员正在积极寻求更难以欺骗的鲁棒分类器，该团队的目标是了解构建鲁棒分类器的新方法并探索其属性。虽然这个项目的这一方面意味着有可能找到针对Tor的更强的WF攻击，但强大的分类器将有助于深度学习的无数应用，比如自动驾驶汽车、文体学、恶意软件检测、处理无人机和卫星图像等等。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Surveillance and tracking on the Internet are growing more pervasive and threaten privacy and freedom of expression. The Tor anonymity system protects the privacy of millions of users, including ordinary citizens, journalists, whistle-blowers, military intelligence, police, businesses, and people living under censorship and surveillance. Unfortunately, Tor is vulnerable to website fingerprinting (WF) attacks in which an eavesdropper uses a machine learning (ML) classifier to identify which website the user is visiting from its traffic patterns. The research team's state-of-the-art WF attack using a deep learning classifier reaches 98% accuracy, which is deeply concerning to Tor and its users. The goal of this project is to explore the new landscape of WF attacks and defenses in light of the team's findings with deep learning. A key aspect of the work is to build upon recent advances in fooling deep learning classifiers and apply these new findings to the context of anonymity systems. Based on this focus on adversarial machine learning, the project will create a new course and an accessible summer camp module on the topic, as well as launch a podcast on Cybersecurity Research featuring interviews with top researchers in the fields of adversarial machine learning and anonymity.The research has three thrusts. First, the team is exploring the impact that these attacks can have for Tor users by addressing how the attacks can generalize to different network conditions and Tor versions, how they can be better adapted to realistic settings, and how they are impacted by real-world user behaviors in Tor. Second, since recent work has shown that it is possible to reliably fool deep learning classifiers, the team is studying how to adapt these techniques for robust and efficient defense. Prior work has primarily been in the image classification domain, whereas network traffic is more challenging to manipulate, so the team is designing new methods that account for this difference. In the third thrust, recognizing that researchers are actively seeking robust classifiers that are harder to fool, the team aims to understand new ways to build robust classifiers and explore their properties. While this aspect of the project means potentially finding stronger WF attacks against Tor, robust classifiers would be helpful for the myriad applications of deep learning, such as self-driving cars, stylometry, malware detection, processing drone and satellite imagery, and more.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.