[Paper Review] Better open-world website fingerprinting.

Jamie Hayes, George Danezis|arXiv (Cornell University)|Sep 2, 2015

Internet Traffic Analysis and Secure E-votingComputer Science4 citations

TL;DR

This paper introduces k-fingerprinting, a website fingerprinting technique using random decision forests that achieves 85% true positive rate and 0.02% false positive rate in identifying hidden services among 100,000 unmonitored web pages, outperforming state-of-the-art methods even under high noise and defense mechanisms.

ABSTRACT

Website fingerprinting enables an attacker to infer which web page a client is browsing through encrypted or anonymized network connections. We present a new website fingerprinting technique based on random decision forests and evaluate performance over standard web pages as well as Tor hidden services, on a larger scale than previous works. Our technique, k-fingerprinting, performs better than current state-of-the-art attacks even against website fingerprinting defenses, and we show that it is possible to launch a website fingerprinting attack in the face of a large amount of noisy data. We can correctly determine which of 30 monitored hidden services a client is visiting with 85% true positive rate (TPR), a false positive rate (FPR) as low as 0.02%, from a world size of 100,000 unmonitored web pages. We further show that error rates vary widely between web resources, and thus some patterns of use will be predictably more vulnerable to attack than others.

Motivation & Objective

• To develop a more effective website fingerprinting technique capable of operating under high noise and defensive countermeasures.
• To evaluate the performance of the proposed method on both standard web pages and Tor hidden services at scale.
• To identify patterns of website usage that are inherently more vulnerable to fingerprinting attacks.
• To demonstrate that website fingerprinting remains feasible even when defenses introduce significant data noise.

Proposed method

• The method employs random decision forests to classify network traffic patterns based on packet-level features.
• It leverages a large-scale dataset including 100,000 unmonitored web pages and 30 monitored hidden services.
• The model is trained to distinguish between monitored and unmonitored websites using statistical features derived from encrypted or anonymized traffic.
• The approach is evaluated under conditions simulating defensive noise, demonstrating robustness to data obfuscation.
• Feature selection focuses on timing, size, and sequence patterns in network flows to improve classification accuracy.
• The system is designed to scale to real-world deployment scenarios involving large web surface areas.

Experimental results

Research questions

• RQ1 Can a website fingerprinting technique maintain high accuracy in the presence of large amounts of noisy data?
• RQ2 How does the proposed method perform on Tor hidden services compared to standard websites?
• RQ3 What is the impact of defensive noise on the performance of website fingerprinting attacks?
• RQ4 Which types of web resources are most vulnerable to fingerprinting due to predictable traffic patterns?
• RQ5 Can random decision forests outperform existing machine learning models in website fingerprinting tasks?

Key findings

• The k-fingerprinting method achieves a true positive rate of 85% when identifying which of 30 monitored hidden services a client is visiting.
• The false positive rate is as low as 0.02%, indicating high precision in classification.
• The technique outperforms current state-of-the-art attacks, even when defenses introduce significant noise.
• Error rates vary significantly across web resources, indicating that some websites are inherently more vulnerable to fingerprinting due to predictable traffic patterns.
• The method remains effective even when the world size of unmonitored pages reaches 100,000, demonstrating scalability and robustness.
• The results show that website fingerprinting remains a practical threat even under realistic defensive conditions.