[Paper Review] Website fingerprinting at scale

Jamie Hayes, George Danezis|arXiv (Cornell University)|Sep 2, 2015

Internet Traffic Analysis and Secure E-voting3 citations

TL;DR

This paper introduces k-fingerprinting, a website fingerprinting technique using random decision forests that achieves 85% true positive rate and 0.02% false positive rate in identifying access to 30 monitored Tor hidden services among 100,000 unmonitored web pages, even under high noise levels, outperforming state-of-the-art methods.

ABSTRACT

Website fingerprinting enables an attacker to infer which web page a client is browsing through encrypted or anonymized network connections. We present a new website fingerprinting technique based on random decision forests and evaluate performance over standard web pages as well as Tor hidden services, on a larger scale than previous works. Our technique, k-fingerprinting, performs better than current state-of-the-art attacks even against website fingerprinting defenses, and we show that it is possible to launch a website fingerprinting attack in the face of a large amount of noisy data. We can correctly determine which of 30 monitored hidden services a client is visiting with 85% true positive rate (TPR), a false positive rate (FPR) as low as 0.02%, from a world size of 100,000 unmonitored web pages. We further show that error rates vary widely between web resources, and thus some patterns of use will be predictably more vulnerable to attack than others.

Motivation & Objective

• To develop a scalable website fingerprinting technique effective against encrypted and anonymized network traffic.
• To evaluate the performance of the proposed method on standard web pages and Tor hidden services at scale.
• To assess the resilience of the technique under high levels of network noise and diverse web access patterns.
• To identify which web resources are inherently more vulnerable to fingerprinting due to predictable traffic patterns.

Proposed method

• The method employs random decision forests to classify network traffic based on packet-level features extracted from encrypted connections.
• It leverages a large-scale dataset of 100,000 unmonitored web pages to simulate realistic background noise.
• The model is trained to distinguish between 30 monitored Tor hidden services and the broader web population.
• Feature engineering focuses on timing, size, and sequence patterns of network packets to capture distinguishable traffic signatures.
• The approach is evaluated under realistic conditions, including high-volume background traffic and diverse user behaviors.
• The system is designed to scale efficiently, enabling real-time inference on large-scale network traffic.

Experimental results

Research questions

• RQ1 Can a website fingerprinting technique maintain high accuracy when faced with 100,000 unmonitored web pages as background noise?
• RQ2 How does the performance of the proposed method compare to state-of-the-art attacks on Tor hidden services?
• RQ3 To what extent do traffic patterns of different web resources affect vulnerability to fingerprinting?
• RQ4 Can the method effectively distinguish between monitored hidden services and the broader web under high noise levels?
• RQ5 Are there predictable patterns in web usage that make certain websites inherently more susceptible to fingerprinting?

Key findings

• The k-fingerprinting technique achieves a true positive rate of 85% when identifying access to 30 monitored Tor hidden services.
• The false positive rate is as low as 0.02%, indicating high precision in distinguishing between monitored and unmonitored pages.
• The method outperforms existing state-of-the-art website fingerprinting attacks, even when defenses are applied.
• Error rates vary significantly across web resources, indicating that some websites are inherently more vulnerable due to predictable traffic patterns.
• The technique remains effective despite a large volume of noisy background traffic, demonstrating robustness in real-world conditions.