Website Fingerprinting Defenses at the Application Layer
Authors: Giovanni Cherubin (Royal Holloway University of London, Egham, UK), Jamie Hayes (University College London, London, UK), Marc Juarez (KU Leuven, ESAT/COSIC and imec, Leuven, Belgium)
Volume: 2017
Issue: 2
Pages: 186–203
DOI: https://doi.org/10.1515/popets-2017-0023
Abstract: Website Fingerprinting (WF) allows a passive network adversary to learn the websites that a client visits by analyzing traffic patterns that are unique to each website. It has been recently shown that these attacks are particularly effective against .onion sites, anonymous web servers hosted within the Tor network. Given the sensitive nature of the content of these services, the implications of WF on the Tor network are alarming. Prior work has only considered defenses at the client-side arguing that web servers lack of incentives to adopt countermeasures. Furthermore, most of these defenses have been designed to operate on the stream of network packets, making practical deployment difficult. In this paper, we propose two application-level defenses including the first server-side defense against WF, as .onion services have incentives to support it. The other defense is a lightweight client-side defense implemented as a browser add-on, improving ease of deployment over previous approaches. In our evaluations, the server-side defense is able to reduce WF accuracy on Tor .onion sites from 69.6% to 10% and the client-side defense reduces accuracy from 64% to 31.5%.
Keywords: privacy, anonymity, website fingerprinting
Copyright in PoPETs articles are held by their authors. This article is published under a Creative Commons Attribution-NonCommercial-NoDerivs 3.0 license.
