[Paper Review] p-FP: Extraction, Classification, and Prediction of Website Fingerprints with Deep Learning

Se Eun Oh, Saikrishna Sunkam+1 more|arXiv (Cornell University)|Nov 10, 2017

Internet Traffic Analysis and Secure E-voting20 references9 citations

TL;DR

This paper proposes a deep learning framework, p-FP, for automated website fingerprinting using CNNs and autoencoders. It demonstrates that DNNs outperform state-of-the-art methods in classifying encrypted web traffic across diverse scenarios—including Tor, search queries, and TLS-encrypted sites—achieving up to 95% true positive rate and 0.04% false positive rate. It further introduces a 99% accurate MLP-based predictor for website fingerprintability using only HTML features.

ABSTRACT

Recent advances in learning Deep Neural Network (DNN) architectures have received a great deal of attention due to their ability to outperform state-of-the-art classifiers across a wide range of applications, with little or no feature engineering. In this paper, we broadly study the applicability of deep learning to website fingerprinting. We show that unsupervised DNNs can be used to extract low-dimensional feature vectors that improve the performance of state-of-the-art website fingerprinting attacks. When used as classifiers, we show that they can match or exceed performance of existing attacks across a range of application scenarios, including fingerprinting Tor website traces, fingerprinting search engine queries over Tor, defeating fingerprinting defenses, and fingerprinting TLS-encrypted websites. Finally, we show that DNNs can be used to predict the fingerprintability of a website based on its contents, achieving 99% accuracy on a data set of 4500 website downloads.

Motivation & Objective

• To investigate the applicability of deep neural networks (DNNs) to website fingerprinting (WF) attacks, especially in reducing reliance on manual feature engineering.
• To evaluate the performance of DNNs—particularly CNNs and MLPs—across diverse WF scenarios, including open-world, multi-class, and defense-evasion settings.
• To develop and validate an unsupervised autoencoder (AE) for low-dimensional feature extraction that enhances existing WF classifiers.
• To design and train a novel fingerprintability predictor using only HTML-level features to identify websites that are inherently more vulnerable to traffic analysis.
• To assess the generalization of the fingerprintability predictor across popular and unpopular websites, including real-world deployment scenarios.

Proposed method

• Employed Multilayer Perceptrons (MLP) and Convolutional Neural Networks (CNN) as end-to-end classifiers for website fingerprinting, directly from raw network traces.
• Used an autoencoder (AE) as an unsupervised feature extractor to learn low-dimensional representations (as small as 20 dimensions) from network traffic, which were then fed into traditional classifiers.
• Trained an MLP classifier on HTML document features—such as link counts, embedded content statistics, and domain diversity—to predict whether a website is fingerprintable (accuracy ≥90%) or not.
• Defined a fingerprintability threshold (e.g., 10–90%) to label websites as fingerprintable (1) or not (0), using the accuracy of a k-FP classifier on Tor traces as ground truth.
• Evaluated the fingerprintability predictor on 4,500 downloads of Alexa top 500 websites and 5,100 instances of unpopular websites (ranked ~1M), using 65 HTML-specific features.
• Applied transfer learning by training on popular websites and testing on unpopular ones to assess robustness and generalization of the fingerprintability model.

Experimental results

Research questions

• RQ1 Can deep neural networks (DNNs) outperform traditional machine learning classifiers in website fingerprinting without extensive manual feature engineering?
• RQ2 To what extent can autoencoders improve the performance of existing state-of-the-art website fingerprinting attacks by learning effective low-dimensional representations?
• RQ3 Can a website’s fingerprintability be accurately predicted using only static HTML features, without access to network traces?
• RQ4 How does the fingerprintability predictor generalize across websites of varying popularity and network behavior?
• RQ5 How effective are DNN-based classifiers in defeating modern traffic padding defenses such as BuFLO, WTF-PAD, and Walkie-Talkie?

Key findings

• CNN-based models achieved a 95% true positive rate and 0.04% false positive rate in classifying 100 monitored websites among 100,000 unmonitored ones using only 9,000 training traces.
• The CNN model successfully fingerprinted websites under four traffic padding defenses—BuFLO (45% accuracy), WTF-PAD (58%), and Walkie-Talkie (54%)—demonstrating effectiveness even against obfuscation techniques.
• Autoencoder-extracted features (as small as 20 dimensions) improved the performance of traditional classifiers, making them more powerful than handcrafted feature sets in prior works.
• The MLP-based fingerprintability predictor achieved 98–99% accuracy in predicting whether a website is fingerprintable (accuracy ≥90%) on a dataset of 4,500 website downloads.
• The fingerprintability predictor maintained 98–99% accuracy and less than 2% MSE when tested on unpopular websites (ranked ~1M), especially when using FP thresholds of 10–30% or 90%.
• Feature importance analysis revealed that domain diversity and embedded content statistics (e.g., number of iframes, scripts) are key indicators of fingerprintability, consistent across both popular and unpopular websites.