Snoopy: A Webpage Fingerprinting Framework with Finite Query Model for Mass-Surveillance

TL;DR

Snoopy is a novel webpage fingerprinting framework designed for mass-surveillance that accurately identifies visited websites across diverse user behaviors while respecting query limits, using static analysis and resource size sequences.

Contribution

Snoopy introduces the first framework for large-scale webpage fingerprinting under finite query constraints, combining static analysis with resource size features for broad user context generalization.

Findings

Achieves ~90% accuracy across various websites and contexts.

Ensemble with ML techniques reaches ~97% accuracy under query limits.

Effective static analysis predicts variations from diverse browsing environments.

Abstract

Internet users are vulnerable to privacy attacks despite the use of encryption. Webpage fingerprinting, an attack that analyzes encrypted traffic, can identify the webpages visited by a user in a given website. Recent research works have been successful in demonstrating webpage fingerprinting attacks on individual users, but have been unsuccessful in extending their attack for mass-surveillance. The key challenges in performing mass-scale webpage fingerprinting arises from (i) the sheer number of combinations of user behavior and preferences to account for, and; (ii) the bound on the number of website queries imposed by the defense mechanisms (e.g., DDoS defense) deployed at the website. These constraints preclude the use of conventional data-intensive ML-based techniques. In this work, we propose Snoopy, a first-of-its-kind framework, that performs webpage fingerprinting for a large number of users visiting a website. Snoopy caters to the generalization requirements of mass-surveillance while complying with a bound on the number of website accesses (finite query model) for traffic sample collection. For this, Snoopy uses a feature (i.e., sequence of encrypted resource sizes) that is either unaffected or predictably affected by different browsing contexts (OS, browser, caching, cookie settings). Snoopy uses static analysis techniques to predict the variations caused by factors such as header sizes, MTU, and User Agent String that arise from the diversity in browsing contexts. We show that Snoopy achieves approximately 90% accuracy when evaluated on most websites, across various browsing contexts. A simple ensemble of Snoopy and an ML-based technique achieves approximately 97% accuracy while adhering to the finite query model, in cases when Snoopy alone does not perform well.