TrafficSliver: Fighting Website Fingerprinting Attacks with Traffic Splitting

ACM SIGSAC Conference on Computer and Communications Security (CCS), pp. 1971–1985

Abstract

Website fingerprinting (WFP) aims to infer information about the content of encrypted and anonymized connections by observing patterns of data flows based on the size and direction of packets. By collecting traffic traces at a malicious Tor entry node --- one of the weakest adversaries in the attacker model of Tor --- a passive eavesdropper can leverage the captured meta-data to reveal the websites visited by a Tor user. As recently shown, WFP is significantly more effective and realistic than assumed. Concurrently, former WFP defenses are either infeasible for deployment in real-world settings or defend against specific WFP attacks only.

Authors 9

1. Wladimir De la Cadena

   University of Luxembourg

   Affiliation as printed

   University of Luxembourg, Esch-sur-Alzette, Luxembourg

2. Asya Mitseva

   Brandenburg University of Technology Cottbus-Senftenberg

   Affiliation as printed

   Brandenburg Technical University, Cottbus, Germany

3. Jens Hiller Aachen

   RWTH Aachen University

   Affiliation as printed

   RWTH Aachen University, Aachen, Germany

4. Jan Pennekamp Aachen

   RWTH Aachen University

   Affiliation as printed

   RWTH Aachen University, Aachen, Germany

5. Sebastian Reuter Aachen

   RWTH Aachen University

   Affiliation as printed

   RWTH Aachen University, Aachen, Germany

6. Julian Filter Aachen

   RWTH Aachen University

   Affiliation as printed

   RWTH Aachen University, Aachen, Germany

7. Thomas Engel

   University of Luxembourg

   Affiliation as printed

   University of Luxembourg, Esch-sur-Alzette, Luxembourg

8. Klaus Wehrle Aachen

   RWTH Aachen University

   Affiliation as printed

   RWTH Aachen University, Aachen, Germany

9. Andriy Panchenko

   Brandenburg University of Technology Cottbus-Senftenberg

   Affiliation as printed

   Brandenburg Technical University, Cottbus, Germany