[论文解读] Robust Website Fingerprinting Through the Cache Occupancy Channel

Anatoly Shusterman, Lachlan Kang+5 more|arXiv (Cornell University)|Nov 17, 2018

Internet Traffic Analysis and Secure E-voting参考文献 81被引用 14

一句话总结

本文证明，通过浏览器缓存侧信道实现的网站指纹识别在现代防御机制下依然极为有效。通过使用JavaScript测量最后一级缓存占用情况，作者实现了对访问网站的高精度分类——其效果与基于网络的指纹识别相当甚至更优，同时对流量整形和定时器分辨率降低等防御措施具有鲁棒性。

ABSTRACT

Website fingerprinting attacks, which use statistical analysis on network traffic to compromise user privacy, have been shown to be effective even if the traffic is sent over anonymity-preserving networks such as Tor. The classical attack model used to evaluate website fingerprinting attacks assumes an on-path adversary, who can observe all traffic traveling between the user's computer and the secure network. In this work we investigate these attacks under a different attack model, in which the adversary is capable of sending a small amount of malicious JavaScript code to the target user's computer. The malicious code mounts a cache side- channel attack, which exploits the effects of contention on the CPU's cache, to identify other websites being browsed. The effectiveness of this attack scenario has never been systematically analyzed, especially in the open-world model which assumes that the user is visiting a mix of both sensitive and non-sensitive sites. We show that cache website fingerprinting attacks in JavaScript are highly feasible. Specifically, we use machine learning techniques to classify traces of cache activity. Unlike prior works, which try to identify cache conflicts, our work measures the overall occupancy of the last- level cache. We show that our approach achieves high classification accuracy in both the open-world and the closed- world models. We further show that our attack is more resistant than network-based fingerprinting to the effects of response caching, and that our techniques are resilient both to network-based defenses and to side-channel countermeasures introduced to modern browsers as a response to the Spectre attack. To protect against cache-based website fingerprinting, new defense mechanisms must be introduced to privacy-sensitive browsers and websites. We investigate one such mechanism, and show that generating artificial cache activity reduces the effectiveness of the attack and completely eliminates it when used in the Tor Browser.

研究动机与目标

• 探究通过恶意JavaScript注入利用CPU缓存侧信道实现网站指纹识别的可行性。
• 在开放世界模型中评估基于缓存的指纹识别，该模型中用户会访问敏感与非敏感网站的混合集合。
• 评估对常见防御措施（如流量整形和降低定时器分辨率）的鲁棒性。
• 提出并评估一种基于人工缓存活动的防御机制，以缓解基于缓存的指纹识别。

提出的方法

• 开发了两种内存程序员，通过随时间测量最后一级缓存占用情况来捕获浏览器缓存活动。
• 使用深度学习模型基于缓存活动轨迹对网站指纹进行分类。
• 在真实用户浏览会话中收集的缓存占用模式上训练分类器。
• 将JavaScript注入受害者浏览器，以在不完全控制网站的情况下监控缓存行为。
• 通过模拟网络级混淆，评估对流量整形防御的鲁棒性。
• 提出并测试了一种涉及人工缓存活动的防御机制，以干扰指纹识别。

实验结果

研究问题

• RQ1 是否可以仅通过JavaScript注入利用CPU缓存侧信道有效实现网站指纹识别？
• RQ2 在开放世界模型中，基于缓存的指纹识别与封闭世界设置相比表现如何？
• RQ3 基于缓存的指纹识别在多大程度上能抵御基于网络的防御措施（如流量整形）？
• RQ4 现代浏览器对策（例如降低定时器分辨率）对基于缓存的指纹识别有多大的有效性？
• RQ5 人工缓存活动是否可作为缓解基于缓存的网站指纹识别的可行防御手段？

主要发现

• 基于缓存的网站指纹识别可实现与最先进的基于网络的指纹识别相当的分类准确率。
• 当浏览器响应缓存处于活动状态时，该方法优于基于网络的指纹识别，原因在于网络流量波动性降低。
• 即使定时器分辨率降低至100毫秒（如Tor浏览器中所示），该攻击依然有效，表明其对浏览器端对策具有鲁棒性。
• 人工缓存活动显著降低了指纹识别的准确率，且在Tor浏览器中使用时可完全消除指纹识别。
• 该方法在不同硬件配置下均表现稳健，基于一个系统训练的分类器可在其他系统上合理泛化。
• 即使缺乏精确的时间对齐，缓存活动仍可作为噪声但可用的信号用于轨迹同步。