TSA-WF: Exploring the Effectiveness of Time Series Analysis for Website Fingerprinting

• URL: http://arxiv.org/abs/2505.14616v2
• Date: Fri, 23 May 2025 16:27:13 GMT
• Title: TSA-WF: Exploring the Effectiveness of Time Series Analysis for Website Fingerprinting
• Authors: Michael Wrana, Uzma Maroof, Diogo Barradas,
• Abstract summary: Website fingerprinting (WF) is a technique that allows an eavesdropper to determine the website a target user is accessing.<n>Recent WF attacks built using machine learning process and summarize trace metadata during their feature extraction phases.<n>We introduce TSA-WF, a pipeline designed to closely preserve network traces' timing and direction characteristics.
• Score: 4.021027132437185
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Website fingerprinting (WF) is a technique that allows an eavesdropper to determine the website a target user is accessing by inspecting the metadata associated with the packets she exchanges via some encrypted tunnel, e.g., Tor. Recent WF attacks built using machine learning (and deep learning) process and summarize trace metadata during their feature extraction phases. This methodology leads to predictions that lack information about the instant at which a given website is detected within a (potentially large) network trace comprised of multiple sequential website accesses -- a setting known as \textit{multi-tab} WF. In this paper, we explore whether classical time series analysis techniques can be effective in the WF setting. Specifically, we introduce TSA-WF, a pipeline designed to closely preserve network traces' timing and direction characteristics, which enables the exploration of algorithms designed to measure time series similarity in the WF context. Our evaluation with Tor traces reveals that TSA-WF achieves a comparable accuracy to existing WF attacks in scenarios where website accesses can be easily singled-out from a given trace (i.e., the \textit{single-tab} WF setting), even when shielded by specially designed WF defenses. Finally, while TSA-WF did not outperform existing attacks in the multi-tab setting, we show how TSA-WF can help pinpoint the approximate instant at which a given website of interest is visited within a multi-tab trace.\footnote{This preprint has not undergone any post-submission improvements or corrections. The Version of Record of this contribution is published in the Proceedings of the 20th International Conference on Availability, Reliability and Security (ARES 2025)}

Related papers

• Attack Smarter: Attention-Driven Fine-Grained Webpage Fingerprinting Attacks [10.525610722239152]
  Website Fingerprinting (WF) attacks aim to infer which websites a user is visiting by analyzing traffic patterns.<n>WPF generalizes WF to large-scale environments by modeling subpages of the same site as distinct classes.<n>We propose an attention-driven fine-grained WPF attack, named ADWPF.
  arXiv  Detail & Related papers  (2025-06-25T01:45:55Z)
• Towards Robust Multi-tab Website Fingerprinting [31.78904724694232]
  Website fingerprinting enables an eavesdropper to determine which websites a user is visiting over an encrypted connection.<n>Existing WF attacks have critical limitations on accurately identifying websites in multi-tab browsing sessions.<n>We propose ARES, a novel WF framework designed for multi-tab WF attacks.
  arXiv  Detail & Related papers  (2025-01-22T04:10:53Z)
• MIETT: Multi-Instance Encrypted Traffic Transformer for Encrypted Traffic Classification [59.96233305733875]
  Classifying traffic is essential for detecting security threats and optimizing network management.<n>We propose a Multi-Instance Encrypted Traffic Transformer (MIETT) to capture both token-level and packet-level relationships.<n>MIETT achieves results across five datasets, demonstrating its effectiveness in classifying encrypted traffic and understanding complex network behaviors.
  arXiv  Detail & Related papers  (2024-12-19T12:52:53Z)
• WFCAT: Augmenting Website Fingerprinting with Channel-wise Attention on Timing Features [16.443437518731383]
  Website Fingerprinting aims to deanonymize users on the Tor network by analyzing encrypted network traffic.<n>Recent deep-learning-based attacks show high accuracy on undefended traces.<n>But they struggle against modern defenses that use tactics like injecting dummy packets and delaying real packets.
  arXiv  Detail & Related papers  (2024-12-16T07:04:44Z)
• Seamless Website Fingerprinting in Multiple Environments [4.226243782049956]
  Website fingerprinting (WF) attacks identify the websites visited over anonymized connections. We introduce a new approach that classifies entire websites rather than individual web pages. Our Convolutional Neural Network (CNN) uses only the jitter and size of 500 contiguous packets from any point in a TCP stream.
  arXiv  Detail & Related papers  (2024-07-28T02:18:30Z)
• EmInspector: Combating Backdoor Attacks in Federated Self-Supervised Learning Through Embedding Inspection [53.25863925815954]
  Federated self-supervised learning (FSSL) has emerged as a promising paradigm that enables the exploitation of clients' vast amounts of unlabeled data. While FSSL offers advantages, its susceptibility to backdoor attacks has not been investigated. We propose the Embedding Inspector (EmInspector) that detects malicious clients by inspecting the embedding space of local models.
  arXiv  Detail & Related papers  (2024-05-21T06:14:49Z)
• A Measurement of Genuine Tor Traces for Realistic Website Fingerprinting [5.4482836906033585]
  Website fingerprinting (WF) is a dangerous attack on web privacy because it enables an adversary to predict the website a user is visiting. We present GTT23, the first WF dataset of genuine Tor traces, which we obtain through a large-scale measurement of the Tor network.
  arXiv  Detail & Related papers  (2024-04-11T16:24:49Z)
• Autoregressive Queries for Adaptive Tracking with Spatio-TemporalTransformers [55.46413719810273]
  rich-temporal information is crucial to the complicated target appearance in visual tracking. Our method improves the tracker's performance on six popular tracking benchmarks.
  arXiv  Detail & Related papers  (2024-03-15T02:39:26Z)
• Realistic Website Fingerprinting By Augmenting Network Trace [17.590363320978415]
  Website Fingerprinting (WF) is considered a major threat to the anonymity of Tor users. We show that augmenting network traces can enhance the performance of WF classifiers in unobserved network conditions.
  arXiv  Detail & Related papers  (2023-09-18T20:57:52Z)
• End-to-end Temporal Action Detection with Transformer [86.80289146697788]
  Temporal action detection (TAD) aims to determine the semantic label and the boundaries of every action instance in an untrimmed video. Here, we construct an end-to-end framework for TAD upon Transformer, termed textitTadTR. Our method achieves state-of-the-art performance on HACS Segments and THUMOS14 and competitive performance on ActivityNet-1.3.
  arXiv  Detail & Related papers  (2021-06-18T17:58:34Z)
• Location-Sensitive Visual Recognition with Cross-IOU Loss [177.86369890708457]
  This paper proposes a unified solution named location-sensitive network (LSNet) for object detection, instance segmentation, and pose estimation. Based on a deep neural network as the backbone, LSNet predicts an anchor point and a set of landmarks which together define the shape of the target object.
  arXiv  Detail & Related papers  (2021-04-11T02:17:14Z)
• Regularized Densely-connected Pyramid Network for Salient Instance Segmentation [73.17802158095813]
  We propose a new pipeline for end-to-end salient instance segmentation (SIS) To better use the rich feature hierarchies in deep networks, we propose the regularized dense connections. A novel multi-level RoIAlign based decoder is introduced to adaptively aggregate multi-level features for better mask predictions.
  arXiv  Detail & Related papers  (2020-08-28T00:13:30Z)
• Temporal Pyramid Network for Action Recognition [129.12076009042622]
  We propose a generic Temporal Pyramid Network (TPN) at the feature-level, which can be flexibly integrated into 2D or 3D backbone networks. TPN shows consistent improvements over other challenging baselines on several action recognition datasets.
  arXiv  Detail & Related papers  (2020-04-07T17:17:23Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.