[论文解读] Automated Feature Extraction for Website Fingerprinting through Deep Learning.

Vera Rimmer, Davy Preuveneers+3 more|arXiv (Cornell University)|Aug 21, 2017

Internet Traffic Analysis and Secure E-voting被引用 12

一句话总结

本文提出了一种基于深度学习的自动化特征提取方法，用于Tor网络中的网站指纹识别，避免了人工特征工程。在超过三百万条网络追踪数据的测试集上，该方法实现了与手工特征相当的性能，同时具备更高的鲁棒性和灵活性。

ABSTRACT

Several studies have shown that the network traffic that is generated by a visit to a website over Tor reveals information specific to the website through the timing and sizes of network packets. By capturing traffic traces between users and their Tor entry guard, a network eavesdropper can leverage this meta-data to reveal which website Tor users are visiting. The success of such attacks heavily depends on the particular set of traffic features that are used to construct the fingerprint. Typically, these features are manually engineered and, as such, any change introduced to the Tor network can render these carefully constructed features ineffective. In this paper, we show that an adversary can automate the feature engineering process, and thus automatically deanonymize Tor traffic by applying our novel method based on deep learning. We evaluate our approach on a dataset comprised of more than three million network traces, which is the largest dataset of web traffic ever gathered for website fingerprinting, and find that the performance achieved by deep learning techniques is comparable to known approaches which include various research efforts spanning over multiple years. Furthermore, it eliminates the need for feature design and selection which is a tedious work and has been one of the main focus of prior work. We conclude that the ability to automatically construct the most relevant traffic features and perform accurate traffic recognition makes our deep learning based approach an efficient, flexible and robust technique for website fingerprinting.

研究动机与目标

• 解决网站指纹识别中手工特征工程的局限性，因为当Tor网络演化时，这些特征会迅速过时。
• 开发一种自动化方法，能够从原始网络追踪数据中动态学习相关流量特征。
• 在文献中此前未见的大型数据集上，评估深度学习在网站指纹识别中的性能表现。
• 证明自动化特征学习可达到甚至超越多年手工优化特征工程的准确性。

提出的方法

• 该方法使用深度神经网络，从原始网络流量追踪中自动提取具有区分性的特征，包括数据包的到达时间与大小。
• 模型在来自Tor用户访问不同网站的网络追踪数据上进行端到端训练，学习将流量模式映射到网站身份。
• 该架构利用数据包序列中的时间与统计模式，识别出与网站相关的指纹特征，而无需预先设计特征。
• 该方法在包含超过三百万条网络追踪的测试数据集上进行评估，涵盖多样化的网站与用户行为。
• 性能通过分类准确率进行衡量，并将深度学习模型与当前最先进的手工特征集进行对比。
• 该方法设计为对协议的微小变更具有鲁棒性，因为它直接从数据中学习特征，而非依赖固定的启发式规则。

实验结果

研究问题

• RQ1 深度学习能否在不依赖手工设计特征的前提下，实现网站指纹识别中的自动化特征工程？
• RQ2 基于深度学习的方法在网站指纹识别中的性能，与传统手工特征工程方法相比如何？
• RQ3 深度学习模型在Tor网络中对多样化网站与网络条件的泛化能力如何？
• RQ4 与手工特征相比，自动化特征学习是否能提升对Tor网络变化的鲁棒性？

主要发现

• 深度学习模型实现了与需要多年手工特征工程的最先进方法相当的分类准确率。
• 该方法消除了繁琐且耗时的手动特征选择与设计过程。
• 该方法对网络变化表现出鲁棒性，因为它直接从数据中学习特征，而非依赖固定启发式规则。
• 该模型在目前已知最大的Tor网络流量数据集上进行了评估，包含超过三百万条网络追踪。
• 结果证实，通过深度学习实现的自动化特征学习是传统指纹识别技术的可行且有效的替代方案。
• 即使在网络条件或流量模式发生轻微变化时，深度学习模型的性能依然保持稳定。