# Tik-Tok: The Utility of Packet Timing in Website Fingerprinting Attacks

## TL;DR

This paper investigates the effectiveness of packet timing features in website fingerprinting attacks on Tor, demonstrating that timing information significantly enhances attack accuracy, especially with directional timing, across various defenses and settings.

## Contribution

The study introduces new timing-related features and evaluates their impact on deep-learning-based WF attacks, showing improved accuracy over previous methods.

## Key findings

- Directional timing achieves up to 98.4% accuracy on undefended Tor traffic.
- Timing features provide complementary information, enhancing classifier robustness.
- Timing-based features improve attack success rates on defended and onion sites.

## Abstract

A passive local eavesdropper can leverage Website Fingerprinting (WF) to deanonymize the web browsing activity of Tor users. The value of timing information to WF has often been discounted in recent works due to the volatility of low-level timing information. In this paper, we more carefully examine the extent to which packet timing can be used to facilitate WF attacks. We first propose a new set of timing-related features based on burst-level characteristics to further identify more ways that timing patterns could be used by classifiers to identify sites. Then we evaluate the effectiveness of both raw timing and directional timing which is a combination of raw timing and direction in a deep-learning-based WF attack. Our closed-world evaluation shows that directional timing performs best in most of the settings we explored, achieving: (i) 98.4% in undefended Tor traffic; (ii) 93.5% on WTF-PAD traffic, several points higher than when only directional information is used; and (iii) 64.7% against onion sites, 12% higher than using only direction. Further evaluations in the open-world setting show small increases in both precision (+2%) and recall (+6%) with directional-timing on WTF-PAD traffic. To further investigate the value of timing information, we perform an information leakage analysis on our proposed handcrafted features. Our results show that while timing features leak less information than directional features, the information contained in each feature is mutually exclusive to one another and can thus improve the robustness of a classifier.