- Website fingerprinting (WFP) aims to infer information about the
content of encrypted and anonymized connections by observing
patterns of data flows based on the size and direction of packets. By
collecting traffic traces at a malicious Tor entry node — one of the
weakest adversaries in the attacker model of Tor — a passive eavesdropper can leverage the captured meta-data to reveal the websites visited by a Tor user. As recently shown, WFP is significantly more effective and realistic than assumed. Concurrently, former WFP defenses are either infeasible for deployment in real-world settings or defend against specific WFP attacks only.
To limit the exposure of Tor users to WFP, we propose novel
lightweight WFP defenses, TrafficSliver, which successfully counter
today’s WFP classifiers with reasonable bandwidth and latency
overheads and, thus, make them attractive candidates for adoption
in Tor. Through user-controlled splitting of traffic over multiple
Tor entry nodes, TrafficSliver limits the data a single entry node
canWebsite fingerprinting (WFP) aims to infer information about the
content of encrypted and anonymized connections by observing
patterns of data flows based on the size and direction of packets. By
collecting traffic traces at a malicious Tor entry node — one of the
weakest adversaries in the attacker model of Tor — a passive eavesdropper can leverage the captured meta-data to reveal the websites visited by a Tor user. As recently shown, WFP is significantly more effective and realistic than assumed. Concurrently, former WFP defenses are either infeasible for deployment in real-world settings or defend against specific WFP attacks only.
To limit the exposure of Tor users to WFP, we propose novel
lightweight WFP defenses, TrafficSliver, which successfully counter
today’s WFP classifiers with reasonable bandwidth and latency
overheads and, thus, make them attractive candidates for adoption
in Tor. Through user-controlled splitting of traffic over multiple
Tor entry nodes, TrafficSliver limits the data a single entry node
can observe and distorts repeatable traffic patterns exploited by
WFP attacks.We first propose a network-layer defense, in which we
apply the concept of multipathing entirely within the Tor network.
We show that our network-layer defense reduces the accuracy from
more than 98% to less than 16% for all state-of-the-art WFP attacks
without adding any artificial delays or dummy traffic. We further
suggest an elegant client-side application-layer defense, which is
independent of the underlying anonymization network. By sending
single HTTP requests for different web objects over distinct Tor
entry nodes, our application-layer defense reduces the detection
rate of WFP classifiers by almost 50 percentage points. Although it
offers lower protection than our network-layer defense, it provides
a security boost at the cost of a very low implementation overhead and is fully compatible with today's Tor network.…
![show more show more](/opus4-UBICO/layouts/opus4/img/arrow_down.png)
![show less show less](/opus4-UBICO/layouts/opus4/img/arrow_up.png)
MetadatenAuthor: | Wladimir De la Cadena, Asya Mitseva, Jens Hiller, Jan Pennekamp, Sebastian Reuter, Julian Filter, Thomas Engel, Klaus Wehrle, Andriy Panchenko |
---|
DOI: | https://doi.org/10.1145/3372297.3423351 |
---|
ISBN: | 978-1-4503-7089-9 |
---|
Title of the source (English): | CCS '20: Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, October 2020 |
---|
Publisher: | Association for Computing Machinery |
---|
Place of publication: | New York |
---|
Document Type: | Conference publication peer-reviewed |
---|
Language: | English |
---|
Year of publication: | 2020 |
---|
Tag: | Anonymous Communication; Onion Routing; Privacy; Traffic Analysis; Web Privacy; Website Fingerprinting |
---|
First Page: | 1971 |
---|
Last Page: | 1985 |
---|
Faculty/Chair: | Fakultät 1 MINT - Mathematik, Informatik, Physik, Elektro- und Informationstechnik / FG IT-Sicherheit |
---|