Towards Robust Multi-tab Website Fingerprinting

TL;DR

This work tackles website fingerprinting in multi-tab Tor browsing, where traditional single-website assumptions fail due to overlapping traffic and unknown tab counts. It introduces ARES, a Transformer-based, multi-label WF framework that deploys multiple Trans-WF classifiers in a one-vs-all fashion to identify multiple websites within a single obfuscated session. Central to ARES are multi-level traffic aggregation, CNN-based local pattern profiling, and a top-m self-attention mechanism that robustly links local patterns across varying tab configurations and defenses, achieving state-of-the-art performance in both closed-world and open-world settings. Extensive experiments on large-scale, real-world multi-tab datasets demonstrate strong accuracy (MAP@k, AUC) and robust defenses, with datasets and code released for reproducibility. The work advances practical WF capabilities and highlights implications for Tor privacy, while outlining potential countermeasures and future XMLC-suitable extensions.

Abstract

Website fingerprinting enables an eavesdropper to determine which websites a user is visiting over an encrypted connection. State-of-the-art website fingerprinting (WF) attacks have demonstrated effectiveness even against Tor-protected network traffic. However, existing WF attacks have critical limitations on accurately identifying websites in multi-tab browsing sessions, where the holistic pattern of individual websites is no longer preserved, and the number of tabs opened by a client is unknown a priori. In this paper, we propose ARES, a novel WF framework natively designed for multi-tab WF attacks. ARES formulates the multi-tab attack as a multi-label classification problem and solves it using the novel Transformer-based models. Specifically, ARES extracts local patterns based on multi-level traffic aggregation features and utilizes the improved self-attention mechanism to analyze the correlations between these local patterns, effectively identifying websites. We implement a prototype of ARES and extensively evaluate its effectiveness using our large-scale datasets collected over multiple months. The experimental results illustrate that ARES achieves optimal performance in several realistic scenarios. Further, ARES remains robust even against various WF defenses.

Figures (8)

• Figure 1: The threat model of ARES. Users open multiple tabs to visit different websites, and the middle nodes of the Tor network may be a defense proxy.
• Figure 2: The overview of ARES.
• Figure 3: Dividing obfuscated traffic and extracting multi-level traffic aggregation features involving packet-level and burst-level features.
• Figure 4: Profiling the traffic pattern generated from each website. The local traffic pattern is correlated with the key elements in a website, which can be extracted by CNN due to its invariant translation.
• Figure 5: The multi-head top-m attention method correlates local traffic patterns for website fingerprinting even in the presence of noise interference. Different from the full connection of the original Transformer, Trans-WF keeps only the top-m attention.