Enhancing Website Fingerprinting Attacks against Traffic Drift

Enhancing Website Fingerprinting Attacks against Traffic Drift

Speakers: Xinhao Deng

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=nuLeN3D94YY

Overview

This talk introduces Proteus, the first adaptive website fingerprinting (WF) attack framework that continuously adapts to real-world traffic drift -- the systematic changes in traffic characteristics over time that cause even state-of-the-art WF attacks to fail in deployment. Unlike prior approaches that require labeled data or reference models, Proteus fine-tunes attack models using only unlabeled traffic observed during deployment, achieving dramatic performance recovery across six drift scenarios including temporal drift spanning nine months, Tor version changes, network condition variations across five countries, and browsing behavior drift across 17,000+ subpages.

The framework integrates seamlessly with all existing deep learning-based WF attacks without modifying their architectures, consistently improving their performance. In the most striking result, Proteus restores the F1 score of the RF attack from 0.17 to over 0.8 when tested across different countries, demonstrating its ability to handle severe real-world drift.

Background

▶ Watch: Background on Tor and website fingerprinting attacks (0:00)

Tor remains the most widely used anonymous communication system, protecting users from tracking, monitoring, and censorship by routing traffic through a randomly selected three-hop circuit with layered encryption. No single relay can link a user to their destination, and all traffic content remains encrypted. However, Tor users remain vulnerable to side-channel attacks, specifically website fingerprinting.

In a WF attack, an adversary such as a local eavesdropper, ISP, or malicious guard node analyzes encrypted traffic patterns -- packet direction, size, and timing -- to infer which website a user visited. Modern deep learning-based WF attacks achieve very high accuracy in controlled laboratory settings but suffer severe performance degradation in real-world deployment due to traffic drift.

Traffic drift arises from three main sources: client-side changes (variations in user behavior, Tor version updates), server-side changes (website content updates), and network-side changes (fluctuating network conditions, traffic obfuscation mechanisms). These factors create a distribution gap between training and deployment data that renders trained models ineffective.

Prior attempts to address traffic drift all have significant limitations. Periodic retraining is straightforward but requires collecting large-scale labeled traffic data, which is extremely time-consuming and costly. Few-shot fine-tuning reduces data requirements but still needs labeled data matching the specific drift scenario -- an unrealistic assumption since drift sources are often unknown. Online adaptation approaches using labeled traffic from Tor exit nodes suffer from a fundamental mismatch: exit node traffic differs significantly from entry node traffic, which is the actual target of WF attacks, especially when entry traffic is protected by WF defenses.

Key Findings

▶ Watch: Limitations of prior approaches and the central research question (4:00)

The research produced several significant findings across a large-scale real-world dataset containing over 350,000 Tor browsing traces:

• Temporal drift: Over 270 days, Proteus achieves an F1 score of approximately 0.8 while all baselines remain below 0.6
• Browsing behavior drift: Under the challenging scenario of unknown subpages, the best baseline achieves only 0.4 F1 while Proteus reaches 0.5 F1 -- still the hardest scenario but a significant improvement
• Cross-country drift: The RF attack's F1 drops to 0.17 when trained on Singapore traffic and tested on Germany/UK traffic; Proteus restores it to over 0.8
• Version drift: Performance improvements scale with the severity of the Tor version gap between training and testing
• Traffic obfuscation: Proteus maintains consistent improvements even against defended traffic using WTF-PAD, OBF-S4, and Front defenses
• The framework integrates with all eight tested DL-based WF attacks without architectural modifications, consistently improving performance
• Performance advantages become more pronounced as drift severity increases

Technical Deep Dive

▶ Watch: Stages 2 and 3: Entropy optimization and adaptive pseudo-labeling (8:00)

Proteus operates through a three-stage pipeline that progressively adapts the attack model to drifted traffic without any ground truth labels.

Stage 1: Feature Distribution Alignment. The first stage aligns the overall feature distributions of original and drifted traffic to eliminate the impact of global drift. This is achieved by minimizing the squared Maximum Mean Discrepancy (MMD) in a high-dimensional feature space induced by an adaptive bandwidth Gaussian kernel. The Gaussian kernel maps traffic features into a Reproducing Kernel Hilbert Space (RKHS) where distributions become more separable and alignment becomes feasible. The adaptive bandwidth dynamically adjusts according to real traffic characteristics, enabling robustness across heterogeneous drift scenarios. This stage must precede the subsequent steps because it establishes average class-level correlations needed for later refinement.

Stage 2: Entropy Distribution Optimization. After alignment, the model still exhibits low prediction confidence on drifted traffic. Using Shannon entropy to measure model uncertainty, the researchers show that as drift increases, entropy of prediction scores gradually rises, leading to more frequent misclassification. A naive approach of maximizing softmax probabilities would bias the model toward dominant classes, especially with unlabeled and imbalanced data. Instead, Proteus performs dual entropy optimization: it minimizes the entropy of each individual prediction to increase confidence while simultaneously maximizing the entropy of the average prediction within each batch to preserve class diversity. This dual objective improves confidence without causing class collapse.

Stage 3: Adaptive Pseudo-Labeling. The final stage enhances discriminative capabilities by generating reliable training labels from the model's own predictions. The key challenge is filtering out incorrect predictions caused by dynamic drift. Proteus fits a Gaussian Mixture Model (GMM) to the entropy distribution of predictions, separately modeling the distributions of correct and incorrect samples. For each prediction, it estimates the posterior probability of being correct and selects only high-probability samples as pseudo-labels for supervised fine-tuning.

The key intuition underlying all three stages is that traffic generated by the same website retains inherent relationships before and after drift, even when surface-level features change significantly.

Demo / Proof of Concept

▶ Watch: Large-scale dataset: 350,000+ Tor traces across six drift scenarios (10:00)

The evaluation was conducted on one of the largest WF datasets assembled, containing over 350,000 Tor browsing traces across six distinct drift scenarios. The temporal drift dataset spans nine months of collection. The Tor version drift dataset covers four major Tor versions. The network condition dataset includes traffic from five countries with varying conditions. The browsing behavior dataset spans over 17,000 subpages of monitored websites. The open-world dataset includes 20,000 unmonitored websites. The defended dataset applies four different traffic obfuscation defenses.

Eight state-of-the-art deep learning-based WF attacks were used as baselines, along with two specialized drift adaptation methods. All evaluation code and datasets were made publicly available on GitHub.

Defensive Implications

▶ Watch: Integration with existing WF attacks and performance under defenses (14:00)

While this research is framed as an attack, it carries significant implications for Tor users and defenders:

• Traffic drift is not a reliable defense: While drift naturally degrades WF attacks, Proteus demonstrates that attackers can overcome this degradation using only unlabeled traffic, which is trivially available during deployment
• WF defenses remain partially effective: Proteus still shows reduced performance against defended traffic, though it consistently improves attack effectiveness compared to unaugmented models
• Padding-based defenses show promise: Among the defenses tested (WTF-PAD, OBF-S4, Front), traffic padding that alters packet sizes remains an effective countermeasure
• Assumption of labeled data requirements no longer holds: Previous defensive threat models assumed attackers needed labeled drift data; Proteus eliminates this requirement entirely
• Continuous monitoring is essential: Organizations concerned about WF attacks should assume that attackers can adapt to changing traffic conditions without manual intervention

Key Takeaways

• Traffic drift -- changes in traffic characteristics over time -- is the primary obstacle to deploying website fingerprinting attacks in practice
• Proteus is the first framework to adapt WF attacks using only unlabeled traffic, eliminating the need for labeled data or reference models
• The three-stage pipeline (feature alignment via MMD, entropy optimization, pseudo-labeling via GMM) handles diverse and unknown drift scenarios
• Proteus integrates with all existing DL-based WF attacks without modifying their architectures
• The framework's advantages increase as drift severity grows, making it particularly valuable in the most challenging real-world conditions
• Defenders should not assume that traffic drift provides adequate natural protection against WF attacks

About the Speaker(s)

The talk was delivered by Xinhao Deng as a surrogate presenter for the first author, who could not attend due to visa issues. The research is a joint collaboration between Tsinghua University and the Zhongguancun Laboratory. The team focuses on network traffic analysis and privacy, with the code and datasets made publicly available for the research community.