Towards Fine-Grained Webpage Fingerprinting at Scale

TL;DR

This paper introduces Oscar, a novel multi-label metric learning-based webpage fingerprinting attack that significantly improves the accuracy of identifying fine-grained webpages from obfuscated traffic, even in complex scenarios.

Contribution

Oscar is the first to apply multi-label metric learning to webpage fingerprinting, enabling high-accuracy identification of similar and multiple webpages simultaneously.

Findings

Oscar achieves 88.6% improvement in Recall@5 over previous methods.

The attack effectively distinguishes highly similar webpages and handles concurrent webpage visits.

Evaluation on real-world traffic from 1,000 monitored and 9,000 unmonitored webpages demonstrates its robustness.

Abstract

Website Fingerprinting (WF) attacks can effectively identify the websites visited by Tor clients via analyzing encrypted traffic patterns. Existing attacks focus on identifying different websites, but their accuracy dramatically decreases when applied to identify fine-grained webpages, especially when distinguishing among different subpages of the same website. WebPage Fingerprinting (WPF) attacks face the challenges of highly similar traffic patterns and a much larger scale of webpages. Furthermore, clients often visit multiple webpages concurrently, increasing the difficulty of extracting the traffic patterns of each webpage from the obfuscated traffic. In this paper, we propose Oscar, a WPF attack based on multi-label metric learning that identifies different webpages from obfuscated traffic by transforming the feature space. Oscar can extract the subtle differences among various webpages, even those with similar traffic patterns. In particular, Oscar combines proxy-based and sample-based metric learning losses to extract webpage features from obfuscated traffic and identify multiple webpages. We prototype Oscar and evaluate its performance using traffic collected from 1,000 monitored webpages and over 9,000 unmonitored webpages in the real world. Oscar demonstrates an 88.6% improvement in the multi-label metric Recall@5 compared to the state-of-the-art attacks.