[Paper Review] Automated Feature Extraction for Website Fingerprinting through Deep Learning.

Vera Rimmer, Davy Preuveneers+3 more|arXiv (Cornell University)|Aug 21, 2017

Internet Traffic Analysis and Secure E-voting12 citations

TL;DR

This paper proposes a deep learning-based method for automated feature extraction in website fingerprinting on Tor, eliminating manual feature engineering. Evaluated on a dataset of over three million traces, the approach achieves performance comparable to hand-crafted features while offering greater robustness and flexibility.

ABSTRACT

Several studies have shown that the network traffic that is generated by a visit to a website over Tor reveals information specific to the website through the timing and sizes of network packets. By capturing traffic traces between users and their Tor entry guard, a network eavesdropper can leverage this meta-data to reveal which website Tor users are visiting. The success of such attacks heavily depends on the particular set of traffic features that are used to construct the fingerprint. Typically, these features are manually engineered and, as such, any change introduced to the Tor network can render these carefully constructed features ineffective. In this paper, we show that an adversary can automate the feature engineering process, and thus automatically deanonymize Tor traffic by applying our novel method based on deep learning. We evaluate our approach on a dataset comprised of more than three million network traces, which is the largest dataset of web traffic ever gathered for website fingerprinting, and find that the performance achieved by deep learning techniques is comparable to known approaches which include various research efforts spanning over multiple years. Furthermore, it eliminates the need for feature design and selection which is a tedious work and has been one of the main focus of prior work. We conclude that the ability to automatically construct the most relevant traffic features and perform accurate traffic recognition makes our deep learning based approach an efficient, flexible and robust technique for website fingerprinting.

Motivation & Objective

• To address the limitation of manually engineered features in website fingerprinting, which become obsolete when the Tor network evolves.
• To develop an automated method that dynamically learns relevant traffic features from raw network traces.
• To evaluate the performance of deep learning in website fingerprinting on a large-scale dataset previously unavailable in the literature.
• To demonstrate that automated feature learning can match or exceed the accuracy of years of manually optimized feature engineering.

Proposed method

• The approach uses deep neural networks to automatically extract discriminative features from raw network traffic traces, including packet timing and sizes.
• The model is trained end-to-end on network traces collected from Tor users visiting various websites, learning to map traffic patterns to website identities.
• The architecture leverages temporal and statistical patterns in packet sequences to identify website-specific fingerprints without prior feature design.
• The method is evaluated on a dataset of over three million network traces, representing diverse websites and user behaviors.
• Performance is measured using classification accuracy, comparing the deep learning model against state-of-the-art manually engineered feature sets.
• The approach is designed to be robust to minor protocol changes, as it learns features directly from data rather than relying on fixed heuristics.

Experimental results

Research questions

• RQ1 Can deep learning automate the feature engineering process in website fingerprinting without relying on manually crafted features?
• RQ2 How does the performance of a deep learning-based approach compare to traditional, manually engineered feature sets in website fingerprinting?
• RQ3 To what extent can a deep learning model generalize across diverse websites and network conditions in the Tor network?
• RQ4 Does automated feature learning improve robustness to changes in the Tor network compared to handcrafted features?

Key findings

• The deep learning model achieves classification accuracy comparable to state-of-the-art methods that required years of manual feature engineering.
• The method eliminates the need for tedious and time-consuming manual feature selection and design.
• The approach demonstrates robustness to network variations, as it learns features directly from data rather than relying on fixed heuristics.
• The model was evaluated on the largest known dataset of Tor web traffic, comprising over three million network traces.
• The results confirm that automated feature learning via deep learning is a viable and effective alternative to traditional fingerprinting techniques.
• The performance of the deep learning model remains stable even when network conditions or traffic patterns shift slightly.