On Multi-Session Website Fingerprinting over TLS Handshake

TL;DR

This paper introduces a deep learning multi-label classifier that predicts websites visited during a period by analyzing server names in TLS handshake packets, demonstrating high accuracy and improved performance over simpler models.

Contribution

The paper presents a novel deep learning approach utilizing server name sequences in TLS handshakes for multi-session website fingerprinting, outperforming basic neural network models.

Findings

Achieved 95% accuracy on test data

Maintained above 90% accuracy on modified and human-made datasets

Using sequential information improves classification performance

Abstract

Analyzing users' Internet traffic data and activities has a certain impact on users' experiences in different ways, from maintaining the quality of service on the Internet and providing users with high-quality recommendation systems to anomaly detection and secure connection. Considering that the Internet is a complex network, we cannot disintegrate the packets for each activity. Therefore we have to have a model that can identify all the activities an Internet user does in a given period of time. In this paper, we propose a deep learning approach to generate a multi-label classifier that can predict the websites visited by a user in a certain period. This model works by extracting the server names appearing in chronological order in the TLSv1.2 and TLSv1.3 Client Hello packets. We compare the results on the test data with a simple fully-connected neural network developed for the same purpose to prove that using the time-sequential information improves the performance. For further evaluations, we test the model on a human-made dataset and a modified dataset to check the model's accuracy under different circumstances. Finally, our proposed model achieved an accuracy of 95% on the test dataset and above 90% on both the modified dataset and the human-made dataset.