首页|抗扰动的网站指纹鲁棒识别方法

抗扰动的网站指纹鲁棒识别方法

Robust identification method of website fingerprinting against disturbance

扫码查看
网站指纹识别通常基于用户浏览网页的流量中暴露的网站指纹特征识别其访问的目标网站,此类技术对于刻画用户的匿名访问行为、提升以Tor为代表的匿名流量监管治理具有重要意义.然而,大量针对性的防御方法通过算法对具有区分性的关键流量特征进行扰动,造成现有网站指纹识别方法的识别准确率大幅下降.现有鲁棒性最优的网站指纹识别(robust fingerprinting,RF)方法能够在多种防御方法上保持较好的性能,但难以抵抗针对性防御方法——RF Countermeasure.为此,提出了基于混合特征矩阵的抗扰动网站指纹鲁棒识别方法.区别于RF,该方法使用包累积长度代替累积包数量作为数据包级特征;运用信息泄露理论分析流特征鲁棒性,基于数据包方向分布和持续同方向数据包数量,构建会话级的鲁棒流特征;综合数据包级和会话级的特征,构建抗多种防御扰动的混合特征矩阵,以该矩阵为输入,采用深度网络模型对网站指纹进行分类识别.基于深度指纹(deep fingerprinting,DF)公开数据集开展了大量实验,结果表明,提出的方法在防御方法RF Countermeasure上的准确率达到95.4%,与现有RF方法相比提高了21.2%,同时该方法在其他典型防御场景下也保持了良好的识别性能.
Website fingerprinting usually identifies the target website visited by users based on the website finger-print characteristics exposed in the web traffic.It is essential in tracking users'anonymous access behaviors and improving the anonymous traffic governance,especially on Tor network flows.However,many defense mecha-nisms emerged to disturb the distinctive traffic patterns,which results in website fingerprint identification failure.The existing website fingerprint identification method with the best robustness named RF can maintain good perfor-mance against various defense methods,but it is difficult to resist the targeted defense method RF Countermeasure.An anti-defense website fingerprinting based on hybrid feature matrix(ADF)was proposed.Unlike RF,ADF used the cumulative packet length instead of the cumulative packet number as the packet-level feature.On the basis of analyzing information leakage value of flow features,ADF constructed the robust flow features of the session level using packet direction distribution and the number of continuous packets in the same direction.Subsequently,a hy-brid feature matrix(HFM)was constructed to resist various defense disturbance by combining the features of both packet-level and session-level.With the matrix as input,a robust flow classifier with convolutional neural network was established.Through extensive experimental analysis on the dataset provided by DF,the accuracy under RF Countermeasure is 95.4%,which is 21.2%higher than RF.This method also maintains good identification perfor-mance under other state-of-the-art defenses.

website fingerprinting identificationanonymous traffic classificationhybrid feature matrixrobust fin-gerprinttraffic analysis

张静茜、李腾耀、涂宇宽、罗向阳

展开 >

信息工程大学,河南 郑州 450001

网络空间态势感知河南省重点实验室,河南 郑州 450001

网站指纹识别 匿名流量分类 混合特征矩阵 鲁棒指纹 流量分析

2024

网络与信息安全学报
人民邮电出版社

网络与信息安全学报

CSTPCD
ISSN:2096-109X
年,卷(期):2024.10(6)