抗扰动的网站指纹鲁棒识别方法

张静茜; 李腾耀; 涂宇宽; 罗向阳

doi:10.11959/j.issn.2096-109x.2024086

您当前的位置：

首页 >

文章列表页 >

抗扰动的网站指纹鲁棒识别方法

学术论文 | 更新时间：2025-02-06

- 抗扰动的网站指纹鲁棒识别方法
- Robust identification method of website fingerprinting against disturbance
- 网络与信息安全学报 2024年10卷第6期页码：137-150
- 作者机构：
  
  1.信息工程大学，河南郑州 450001
  2.网络空间态势感知河南省重点实验室，河南郑州 450001
- 作者简介：
  
  [ "张静茜（2002- ），女，云南昆明人，信息工程大学硕士生，主要研究方向为流量分析、匿名流量识别。" ]
  [ "李腾耀（1991- ），男，河北辛集人，博士，信息工程大学讲师，主要研究方向为匿名流量识别、去匿名化。" ]
  [ "涂宇宽（2000- ），男，河南信阳人，信息工程大学博士生，主要研究方向为流量分析。" ]
  [ "罗向阳（1978- ），男，湖北荆门人，博士，信息工程大学教授、博士生导师，主要研究方向为网络与信息安全。" ]
- 基金信息：
  
  国家重点研发计划;The National Key Research and Development Program of China(2022YFB3102900);国家自然科学基金(62172435;U23A20305);河南省重点研发项目(221111321200)
- DOI：10.11959/j.issn.2096-109x.2024086
  中图分类号： TP393
- 收稿：2024-05-18，
  
  修回：2024-06-24，
  
  纸质出版：2024-12-25
- 稿件说明：
移动端阅览
张静茜, 李腾耀, 涂宇宽, 等. 抗扰动的网站指纹鲁棒识别方法[J]. 网络与信息安全学报, 2024, 10(6): 137-150.

ZHANG J X, LI T Y, TU Y K, et al. Robust identification method of website fingerprinting against disturbance[J]. Chinese Journal of Network and Information Security, 2024, 10(6): 137-150.
张静茜, 李腾耀, 涂宇宽, 等. 抗扰动的网站指纹鲁棒识别方法[J]. 网络与信息安全学报, 2024, 10(6): 137-150. DOI： 10.11959/j.issn.2096-109x.2024086.

ZHANG J X, LI T Y, TU Y K, et al. Robust identification method of website fingerprinting against disturbance[J]. Chinese Journal of Network and Information Security, 2024, 10(6): 137-150. DOI： 10.11959/j.issn.2096-109x.2024086.

摘要

网站指纹识别通常基于用户浏览网页的流量中暴露的网站指纹特征识别其访问的目标网站，此类技术对于刻画用户的匿名访问行为、提升以Tor为代表的匿名流量监管治理具有重要意义。然而，大量针对性的防御方法通过算法对具有区分性的关键流量特征进行扰动，造成现有网站指纹识别方法的识别准确率大幅下降。现有鲁棒性最优的网站指纹识别（robust fingerprinting

RF）方法能够在多种防御方法上保持较好的性能，但难以抵抗针对性防御方法——RF Countermeasure。为此，提出了基于混合特征矩阵的抗扰动网站指纹鲁棒识别方法。区别于RF，该方法使用包累积长度代替累积包数量作为数据包级特征；运用信息泄露理论分析流特征鲁棒性，基于数据包方向分布和持续同方向数据包数量，构建会话级的鲁棒流特征；综合数据包级和会话级的特征，构建抗多种防御扰动的混合特征矩阵，以该矩阵为输入，采用深度网络模型对网站指纹进行分类识别。基于深度指纹（deep fingerprinting

DF）公开数据集开展了大量实验，结果表明，提出的方法在防御方法RF Countermeasure上的准确率达到95.4%，与现有RF方法相比提高了21.2%，同时该方法在其他典型防御场景下也保持了良好的识别性能。

Abstract

Website fingerprinting usually identifies the target website visited by users based on the website fingerprint characteristics exposed in the web traffic. It is essential in tracking users’ anonymous access behaviors and improving the anonymous traffic governance

especially on Tor network flows. However

many defense mechanisms emerged to disturb the distinctive traffic patterns

which results in website fingerprint identification failure. The existing website fingerprint identification method with the best robustness named RF can maintain good performance against various defense methods

but it is difficult to resist the targeted defense method RF Countermeasure. An anti-defense website fingerprinting based on hybrid feature matrix (ADF) was proposed. Unlike RF

ADF used the cumulative packet length instead of the cumulative packet number as the packet-level feature. On the basis of analyzing information leakage value of flow features

ADF constructed the robust flow features of the session level using packet direction distribution and the number of continuous packets in the same direction. Subsequently

a hybrid feature matrix (HFM) was constructed to resist various defense disturbance by combining the features of both packet-level and session-level. With the matrix as input

a robust flow classifier with convolutional neural network was established. Through extensive experimental analysis on the dataset provided by DF

the accuracy under RF Countermeasure is 95.4%

which is 21.2% higher than RF. This method also maintains good identification performance under other state-of-the-art defenses.

关键词

Keywords

references

邹鸿程 , 苏金树 , 魏子令 , 等 . 网站指纹识别与防御研究综述 [J ] . 计算机学报 , 2022 , 45 ( 10 ): 2243 - 2278 .

ZOU H C , SU J S , WEI Z L , et al . A review of the research of website fingerprinting identification and defense [J ] . Chinese Journal of Computers , 2022 , 45 ( 10 ): 2243 - 2278 .

SIRINAM P , IMANI M , JUAREZ M , et al . Deep fingerprinting: undermining website fingerprinting defenses with deep learning [C ] // Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2018 : 1928 - 1943 .

RAHMAN M S , SIRINAM P , MATHEWS N , et al . Tik-tok: the utility of packet timing in website fingerprinting attacks [J ] . Privacy Enhancing Technologies , 2020 , 2020( 3 ): 5 - 24 .

BHAT S , LU D , KWON A , et al . Var-CNN: a data-efficient website fingerprinting attack based on deep learning [J ] . Privacy Enhancing Technologies , 2019 , 2019( 4 ): 292 - 310 .

JUAREZ M , IMANI M , PERRY M , et al . Toward an efficient website fingerprinting defense [C ] // Proceedings of European Symposium on Research in Computer Security . Cham : Springer , 2016 : 27 - 46 .

GONG J , WANG T . Zero-delay lightweight defenses against website fingerprinting [C ] // Proceedings of 29th USENIX Security Symposium (USENIX Security) , 2020 : 717 - 734 .

SHEN M , JI K , GAO Z , et al . Subverting website fingerprinting defenses with robust traffic representation [C ] // Proceedings of 32nd USENIX Security Symposium (USENIX Security 23). 2023 : 607 - 624 .

XIAO X , ZHOU X , YANG Z Y , et al . A comprehensive analysis of website fingerprinting defenses on Tor [J ] . Computers & Security , 2024 , 136 : 103577 .

WANG T , CAI X , NITHYANAND R , et al . Effective attacks and provable defenses for website fingerprinting [C ] // Proceedings of 23rd USENIX Security Symposium (USENIX Security 14). 2014 : 143 - 157 .

PANCHENKO A , LANZE F B , ZINNEN A , et al . Website fingerprinting at Internet scale [C ] // Proceedings of 2016 Network and Distributed System Security Symposium . Reston, VA : Internet Society , 2016 : 1 - 16 .

HAYES J , DANEZIS G . K-fingerprinting: a robust scalable website fingerprinting technique [EB ] . arXiv Preprint arXiv: 1509.00789 , 2015 .

赵文博 , 马紫彤 , 杨哲 . 基于超图神经网络的恶意流量分类模型 [J ] . 网络与信息安全学报 , 2023 , 9 ( 5 ): 166 - 177 .

ZHAO W B , MA Z T , YANG Z . Model of the malicious traffic classification based on hypergraph neural network [J ] . Chinese Journal of Network and Information Security , 2023 , 9 ( 5 ): 166 - 177 .

谢绒娜 , 马铸鸿 , 李宗俞 , 等 . 基于卷积神经网络的加密流量分类方法 [J ] . 网络与信息安全学报 , 2022 , 8 ( 6 ): 84 - 91 .

XIE R N , MA Z H , LI Z Y , et al . Encrypted traffic classification method based on convolutional neural network [J ] . Chinese Journal of Network and Information Security , 2022 , 8 ( 6 ): 84 - 91 .

SIRINAM P , MATHEWS N , RAHMAN M S , et al . Triplet fingerprinting: more practical and portable website fingerprinting with N-shot learning [C ] // Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2019 : 1131 - 1148 .

OH S E , MATHEWS N , RAHMAN M S , et al . Gandalf: gan for data-limited fingerprinting [C ] // Proceedings of Privacy Enhancing Technologies , 2021 : 305 - 322 .

WANG T , GOLDBERG I . {Walkie-Talkie}: An efficient defense against passive website fingerprinting attacks [C ] // Proceedings of 26th USENIX Security Symposium (USENIX Security 17). 2017 : 1375 - 1390 .

LI S , GUO H J , HOPPER N . Measuring information leakage in website fingerprinting attacks and defenses [C ] // Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2018 : 1977 - 1992 .

SHMATIKOV V , WANG M H . Timing analysis in low-latency mix networks: attacks and defenses [C ] // Proceedings of European Symposium on Research in Computer Security (ESORICS) , 2006 : 18 - 33 .

JUAREZ M , AFROZ S , ACAR G , et al . A critical evaluation of website fingerprinting attacks [C ] // Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2014 : 263 - 274 .

PANCHENKO A , NIESSEN L , ZINNEN A , et al . Website fingerprinting in onion routing based anonymization networks [C ] // Proceedings of the 10th annual ACM Workshop on Privacy in the Electronic Society . New York : ACM , 2011 : 103 - 114 .

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

面向不平衡样本的物联网入侵检测方法

面向高速网络流量的加密混淆型WebShell检测