A Website Fingerprinting Attack Method via Convolutional Neural Network Optimized by Genetic Algorithm

doi:10.3969/j.issn.1671-1122.2021.09.009

Abstract

Abstract:

Website fingerprinting attack is often used to analyze the user access behavior of Tor network, and the analysis effect is limited by the construction of fingerprinting traffic feature set. After manual feature engineering and feature selection, a set of fingerprinting features can be obtained, which can represent the attack mode. With the update of Tor network protocol, the traffic characteristics extracted manually may be invalid. In this paper, a convolutional neural network fingerprinting attack method optimized by genetic algorithm was proposed to realize the automatic extraction of traffic characteristics. Compared with the existing fingerprinting attack research, the recognition accuracy of this method is improved in closed world dataset and open world dataset.

Key words: website fingerprinting attack, Tor network, convolutional neural network, genetic algorithm

CLC Number:

TP309

LI Yanlin, CAI Manchun, LU Tianliang, XI Rongkang. A Website Fingerprinting Attack Method via Convolutional Neural Network Optimized by Genetic Algorithm[J]. Netinfo Security, 2021, 21(9): 59-66.

Figures/Tables 10

References 19

[1]	HERRMANN D, WENDOLSKY R, FEDERRATH H. Website Fingerprinting: Attacking Popular Privacy Enhancing Technologies with the Multinomial Naïve-Bayes Classifier [C]//ACM. CCS ’09: 16th ACM Conference on Computer and Communications Security 2009, November 13, 2009, Chicago, Illinois, USA. New York: ACM, 2009: 31-42.
[2]	CAI Xiang, NITHYANAND R, WANG Tao, et al. A Systematic Approach to Developing and Evaluating Website Fingerprinting Defenses [C]//ACM. CCS’14: 2014 ACM SIGSAC Conference on Computer and Communications Security, November 3-7, 2014, Scottsdale, Arizona, USA. New York: ACM, 2014: 227-238.
[3]	JUAREZ M, AFROZ S, ACAR G, et al. A Critical Evaluation of Website Fingerprinting Attacks [C]// ACM. CCS’14: 2014 ACM SIGSAC Conference on Computer and Communications Security, November 3-7, 2014, Scottsdale, Arizona, USA. New York: ACM, 2014: 263-274.
[4]	CHENG H, AVNUR R. Traffic Analysis of SSL Encrypted Web Browsing[EB/OL]. https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.3.1201&rep=rep1&type=pdf, 2021-01-19.
[5]	SUN Qixiang, SIMON D R, WANG Yimin, et al. Statistical Identification of Encrypted Web Browsing Traffic [C]//IEEE. 2002 IEEE Symposium on Security and Privacy, May 12-15, 2002, Berkeley, CA, USA. Washington, D. C: IEEE, 2002: 19-30.
[6]	LIBERATORE M, LEVINE B N. Inferring the Source of Encrypted Http Connections [C]//ACM. CCS’06: 13th ACM Conference on Computer and Communications Security 2006, October 30-November 3, 2006, Alexandria, Virginia, USA. New York: ACM, 2006: 255-263.
[7]	PANCHENKO A, NIESSEN L, ZINNEN A, et al. Website Fingerprinting in Onion Routing Based Anonymization Networks [C]//ACM. CCS’11: the ACM Conference on Computer and Communications Security Proceedings of the 10th annual ACM workshop on Privacy in the Electronic Society, October 17, 2011, Chicago, Illinois, USA. New York: ACM, 2011: 103-114.
[8]	CAI Xiang, ZHANG Xincheng, JOSHI B, et al. Touching from a Distance: Website Fingerprinting Attacks and Defenses [C]//ACM. CCS’12: the ACM Conference on Computer and Communications Security, October 16-18, 2012, Raleigh, North Carolina, USA. New York: ACM, 2012: 605-616.
[9]	WANG Tao, GOLDBERG I. Improved Website Fingerprinting on Tor [C]//ACM. CCS'13: 2013 ACM SIGSAC Conference on Computer and Communications Security, November 4, 2013, Berlin, Germany. New York: ACM, 2013: 201-212.
[10]	WANG Tao, CAI Xiang, NITHYANAND R, et al. Effective Attacks and Provable Defenses for Website Fingerprinting [C]//USENIX. 23rd USENIX Security Symposium, August 20-22, 2014, San Diego, CA, USA. CA: USENIX, 2014: 143-157.
[11]	PANCHENKO A, LANZE F, PENNEKAMP J, et al. Website Fingerprinting at Internet Scale[EB/OL]. https://orbilu.uni.lu/handle/10993/24117, 2021-01-22.
[12]	HAYES J, DANEZIS G. K-Fingerprinting: A Robust Scalable Website Fingerprinting Technique [C]//USENIX. 25th USENIX Security Symposium, August 10-12, 2016, Austin, Texas, USA. CA: USENIX, 2016: 1187-1203.
[13]	WANG Zhanyi. The Applications of Deep Learning on Traffic Identification[J]. BlackHat USA, 2015, 24(11): 1-10.
[14]	ABE K, GOTO S. Fingerprinting Attack on Tor Anonymity Using Deep Learning[J]. Proceedings of the Asia-Pacific Advanced Network, 2016, 42(4): 15-20.
[15]	RIMMER V, PREUVENEERS D, JUAREZ M, et al. Automated Website Fingerprinting Through Deep Learning[EB/OL]. https://arxiv.org/abs/1708.06376, 2021-01-25.
[16]	SIRINAM P, IMANI M, JUAREZ M, et al. Deep Fingerprinting: Undermining Website Fingerprinting Defenses with Deep Learning [C]//ACM. CCS’18: 2018 ACM SIGSAC Conference on Computer and Communications Security, October 15-19, 2018, Toronto, Canada. New York: ACM, 2018: 1928-1943.
[17]	BHAT S, LU D, KWON A, et al. Var-cnn: A Data-efficient Website Fingerprinting Attack Based on Deep Learning[EB/OL]. https://dspace.mit.edu/handle/1721.1/129817, 2021-02-25.
[18]	RAHMAN M S, SIRINAM P, MATHEWS N, et al. Tik-Tok: The Utility of Packet Timing in Website Fingerprinting Attacks[EB/OL]. https://arxiv.org/abs/1902.06421, 2021-02-27.
[19]	MA Chencheng, DU Xuehui, CAO Lifeng, et al. Burst-Analysis Website Fingerprinting Attack Based on Deep Neural Network[J]. Journal of Computer Research and Development, 2020, 57(4): 746.
	马陈城, 杜学绘, 曹利峰, 等. 基于深度神经网络 burst 特征分析的网站指纹攻击方法[J]. 计算机研究与发展, 2020, 57(4): 746.

配置	参数
操作系统	Windows 10 专业版
处理器	Intel Core i5-6300HQ
内存	8 G 2333MHz
Python	3.6.8
Tensorflow	1.13.1
Keras	2.2.4

参数	范围	取值
优化器	SGD, Adam, RMSProp	RMSProp
激活函数	tanh, sigmoid, relu	tanh
学习率	0.0009 ~ 0.0025	0.001
卷积核数	4 ~ 128	32
卷积核大小	2 ~ 50	5
dropout	0 ~ 0.5	0.1
epochs	0 ~ 50	30

参数	取值
种群数	40
最大遗传代数	50
选择率	0.1
保留率	0.4
变异率	0.2