Towards Robust Multi-tab Website Fingerprinting

2025-01-22

AI Summary

Website fingerprinting (WF) accuracy degrades significantly in multi-tab browsing scenarios, where conventional single-label assumptions fail to capture co-occurrence patterns and traffic interleaving among concurrent tabs. Method: This paper proposes ARES, the first framework to formulate WF recognition as a multi-label coexistence identification task. It introduces a dedicated Transformer architecture for multi-label WF, integrating multi-level traffic aggregation for feature extraction and an enhanced self-attention mechanism to robustly identify an arbitrary number of concurrent tabs. A multi-label classification learning paradigm is adopted. Results: Evaluated on a large-scale real-world dataset, ARES substantially outperforms state-of-the-art methods under mainstream defenses—including Tor and WTF-PAD—demonstrating strong robustness. It establishes a novel, practical paradigm for WF recognition in realistic browser environments.

Technology Category

• Machine Learning: Multi-class/Multi-label Learning & Extreme Classification
• Computer Vision: Multi-modal Vision
• Application Domains: Mobility, Driving & Flight

Application Category

• Responsible Web: Data and user privacy-enhancing technologies for the Web
• Web Mining and Content Analysis: Web measurements
• Systems and Infrastructure for Web, Mobile and WoT: Web performance, measurement, and characterization

Abstract

Website fingerprinting enables an eavesdropper to determine which websites a user is visiting over an encrypted connection. State-of-the-art website fingerprinting (WF) attacks have demonstrated effectiveness even against Tor-protected network traffic. However, existing WF attacks have critical limitations on accurately identifying websites in multi-tab browsing sessions, where the holistic pattern of individual websites is no longer preserved, and the number of tabs opened by a client is unknown a priori. In this paper, we propose ARES, a novel WF framework natively designed for multi-tab WF attacks. ARES formulates the multi-tab attack as a multi-label classification problem and solves it using the novel Transformer-based models. Specifically, ARES extracts local patterns based on multi-level traffic aggregation features and utilizes the improved self-attention mechanism to analyze the correlations between these local patterns, effectively identifying websites. We implement a prototype of ARES and extensively evaluate its effectiveness using our large-scale datasets collected over multiple months. The experimental results illustrate that ARES achieves optimal performance in several realistic scenarios. Further, ARES remains robust even against various WF defenses.

Problem

• Multi-label Browsing
• Website Fingerprinting
• Accuracy Improvement

Innovation

• ARES system
• Transformer model
• Multi-label web browsing