CipherSight: Robust Website Fingerprinting via Record-Resource Semantic Supervision under Distribution Shifts

• URL: http://arxiv.org/abs/2608.13905v1
• Date: Fri, 14 Aug 2026 03:17:57 GMT
• Title: CipherSight: Robust Website Fingerprinting via Record-Resource Semantic Supervision under Distribution Shifts
• Abstract summary: HTTPS website fingerprinting aims to identify visited websites from metadata observable in encrypted traffic.<n>Existing methods primarily learn from raw TCP packet sequences.<n>We propose CipherSight, a TLS-record-based hierarchical framework for robust HTTPS WF.
• Score: 5.86043296080285
• License: http://creativecommons.org/licenses/by-nc-sa/4.0/
• Abstract: HTTPS website fingerprinting (WF) aims to identify visited websites from metadata observable in encrypted traffic. However, real-world deployments introduce a significant out-of-distribution (OOD) problem caused by temporal and geographic changes, while previously unseen websites are common in open-world scenarios. Existing methods primarily learn from raw TCP packet sequences and struggle to capture stable and generalizable website representations, resulting in performance degradation under practical conditions. We propose CipherSight, a TLS-record-based hierarchical framework for robust HTTPS WF. Unlike existing approaches that rely on TCP packet sequences and are sensitive to transport-layer artifacts, CipherSight learns website representations from TLS records by jointly encoding multiple record-level attributes. It introduces a hierarchical architecture that captures both intra-flow dependencies among TLS records and inter-flow interactions across concurrent flows, enabling the model to exploit structural patterns in HTTPS traffic. Besides, to learn robust representations, CipherSight employs a masked record modeling (MRM) task to capture contextual traffic semantics and leverages fine-grained record-resource annotations as privileged supervision through structure-aware objectives and semantic distillation. Experiments show that CipherSight achieves 95.41% accuracy across more than 2,000 website classes in the closed-world setting and maintains over 90% accuracy under both temporal and geographic drift, consistently outperforming all evaluated baselines.

Related papers

• The Colossus with Feet of Clay: Debunking Encrypted Traffic Classifiers under PQC Evolution [6.277767508192155]
  TLS migration toward post-quantum cryptography (PQC) challenges assumption because hybrid key establishment can reshape observable traffic without changing application labels.<n>We frame this change as PQC-induced protocol drift and study its effects through closed-world HTTPS website fingerprinting.<n>We offer strategic guidance, identify cross-domain fragility as a research priority, and recommend protocol-aware practices for dependable real-world encrypted traffic classification.
  arXiv  Detail & Related papers  (2026-08-24T00:51:11Z)
• Weird Machines in Transport Layer Security [4.816146174353995]
  This paper extends weird machine theory to the Transport Layer Security (TLS) handshake and its two dominant implementations, OpenSSL and BoringSSL.<n>We show that legitimate TLS primitives compose into Turing-complete systems whose computation is coupled to authentication and trust decisions rather than physical actuation.<n>We validate this theory with two working demonstrations built on real OpenSSL code paths.
  arXiv  Detail & Related papers  (2026-08-13T18:28:01Z)
• Beyond Domains: Reusing Web Skills via Transferable Interaction Patterns [68.0603867264595]
  SkillMigrator learns reusable web skills and transfers them across sites by matching layout structure rather than specific element references.<n>It reduces the average LLM-action count on successful trajectories by 8-10% across both WebArena and Mind2Web at matched success rate.
  arXiv  Detail & Related papers  (2026-06-16T08:04:35Z)
• More Than Meets the Eye: A Semantics-Aware Traffic Augmentation Framework for Generalizable Website Fingerprinting [7.434353180305326]
  SATA is a semantics-aware traffic augmentation framework.<n>It generates traffic patterns that are absent from the training set but genuinely exist in the test set.<n>It significantly improves the performance of mainstream models across diverse and complex scenarios.
  arXiv  Detail & Related papers  (2026-05-12T01:48:05Z)
• PrismWF: A Multi-Granularity Patch-Based Transformer for Robust Website Fingerprinting Attack [45.608550871415]
  Tor is a low-latency anonymous communication network that protects user privacy by encrypting website traffic.<n>Recent website fingerprinting (WF) attacks have shown that encrypted traffic can still leak users' visited websites by exploiting statistical features such as packet size, direction, and inter-arrival time.<n>We propose PrismWF, a multi-granularity patch-based Transformer for multi-tab WF attack.
  arXiv  Detail & Related papers  (2026-03-22T08:17:03Z)
• PACC: Protocol-Aware Cross-Layer Compression for Compact Network Traffic Representation [10.787806670196938]
  PACC is a redundancy-aware, layer-aware representation framework.<n>It consistently outperforms feature-engineered and raw-bit baselines.<n>It improves end-to-end efficiency by up to 3.16x.
  arXiv  Detail & Related papers  (2026-02-09T07:09:31Z)
• DynaPURLS: Dynamic Refinement of Part-aware Representations for Skeleton-based Zero-Shot Action Recognition [51.80782323686666]
  We introduce textbfDynaPURLS, a unified framework that establishes robust, multi-scale visual-semantic correspondences.<n>Our framework leverages a large language model to generate hierarchical textual descriptions that encompass both global movements and local body-part dynamics.<n>Experiments on three large-scale benchmark datasets, including NTU RGB+D 60/120 and PKU-MMD, demonstrate that DynaPURLS significantly outperforms prior art.
  arXiv  Detail & Related papers  (2025-12-12T10:39:10Z)
• MIETT: Multi-Instance Encrypted Traffic Transformer for Encrypted Traffic Classification [59.96233305733875]
  Classifying traffic is essential for detecting security threats and optimizing network management.<n>We propose a Multi-Instance Encrypted Traffic Transformer (MIETT) to capture both token-level and packet-level relationships.<n>MIETT achieves results across five datasets, demonstrating its effectiveness in classifying encrypted traffic and understanding complex network behaviors.
  arXiv  Detail & Related papers  (2024-12-19T12:52:53Z)
• Part-aware Unified Representation of Language and Skeleton for Zero-shot Action Recognition [57.97930719585095]
  We introduce Part-aware Unified Representation between Language and Skeleton (PURLS) to explore visual-semantic alignment at both local and global scales. Our approach is evaluated on various skeleton/language backbones and three large-scale datasets. The results showcase the universality and superior performance of PURLS, surpassing prior skeleton-based solutions and standard baselines from other domains.
  arXiv  Detail & Related papers  (2024-06-19T08:22:32Z)
• FLIP: Fine-grained Alignment between ID-based Models and Pretrained Language Models for CTR Prediction [49.510163437116645]
  Click-through rate (CTR) prediction plays as a core function module in personalized online services. Traditional ID-based models for CTR prediction take as inputs the one-hot encoded ID features of tabular modality. Pretrained Language Models(PLMs) has given rise to another paradigm, which takes as inputs the sentences of textual modality. We propose to conduct Fine-grained feature-level ALignment between ID-based Models and Pretrained Language Models(FLIP) for CTR prediction.
  arXiv  Detail & Related papers  (2023-10-30T11:25:03Z)
• Dynamic Focus-aware Positional Queries for Semantic Segmentation [94.6834904076914]
  We propose a simple yet effective query design for semantic segmentation termed Dynamic Focus-aware Positional Queries. Our framework achieves SOTA performance and outperforms Mask2former by clear margins of 1.1%, 1.9%, and 1.1% single-scale mIoU with ResNet-50, Swin-T, and Swin-B backbones.
  arXiv  Detail & Related papers  (2022-04-04T05:16:41Z)
• Temporal-attentive Covariance Pooling Networks for Video Recognition [52.853765492522655]
  existing video architectures usually generate global representation by using a simple global average pooling (GAP) method. This paper proposes a attentive Covariance Pooling( TCP- TCP), inserted at the end of deep architectures, to produce powerful video representations. Our TCP is model-agnostic and can be flexibly integrated into any video architectures, resulting in TCPNet for effective video recognition.
  arXiv  Detail & Related papers  (2021-10-27T12:31:29Z)
• MD-CSDNetwork: Multi-Domain Cross Stitched Network for Deepfake Detection [80.83725644958633]
  Current deepfake generation methods leave discriminative artifacts in the frequency spectrum of fake images and videos. We present a novel approach, termed as MD-CSDNetwork, for combining the features in the spatial and frequency domains to mine a shared discriminative representation.
  arXiv  Detail & Related papers  (2021-09-15T14:11:53Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.