Robust identification method of website fingerprinting against disturbance

Website fingerprinting usually identifies the target website visited by users based on the website fingerprint characteristics exposed in the web traffic. It is essential in tracking users’ anonymous access behaviors and improving the anonymous traffic governance, especially on Tor network flows. However, many defense mechanisms emerged to disturb the distinctive traffic patterns, which results in website fingerprint identification failure. The existing website fingerprint identification method with the best robustness named RF can maintain good performance against various defense methods, but it is difficult to resist the targeted defense method RF Countermeasure. An anti-defense website fingerprinting based on hybrid feature matrix (ADF) was proposed. Unlike RF, ADF used the cumulative packet length instead of the cumulative packet number as the packet-level feature. On the basis of analyzing information leakage value of flow features, ADF constructed the robust flow features of the session level using packet direction distribution and the number of continuous packets in the same direction. Subsequently, a hybrid feature matrix (HFM) was constructed to resist various defense disturbance by combining the features of both packet-level and session-level. With the matrix as input, a robust flow classifier with convolutional neural network was established. Through extensive experimental analysis on the dataset provided by DF, the accuracy under RF Countermeasure is 95.4%, which is 21.2% higher than RF. This method also maintains good identification performance under other state-of-the-art defenses.