AdaWFPA: Adaptive Online Website Fingerprinting Attack for Tor Anonymous Network: A Stream-wise Paradigm

摘要

Nowadays, network traffic analysis is quite pervasive in human practice. Website fingerprinting attack, which is a new variant of traffic analysis attacks, identifies the websites visited by clients in encrypted and anonymized Tor connections by observing patterns in packet flows. Previous website fingerprinting attacks focus on static models in which the classifier is trained within a time period and then it is utilized to identify targeted websites. Static attacks cannot handle the time effect on the accuracy since their classifiers are not trained on the newest versions of the websites. Consequently, their accuracy drops drastically when tested on captured traffic traces of websites, days after training. This time effect is known as concept drift.In order to maintain the performance of the classifier, the classifier must be updated over time. In static attacks, updating the classifier includes updating the whole dataset again along with retraining the classifier. Recollecting, maintaining, and updating datasets as well as updating and retraining the classifier are very time and memory consuming. To deal with the emerging issues arising from concept drift and expensive retraining phases, this paper proposes AdaWFPA; an adaptive online website fingerprinting attack which is based on adaptive stream mining algorithms. AdaWFPA avoids concept drift by updating its model over time. Our empirical analyses and experiments over real world datasets indicate the superiority of our approach; as it offers better accuracy, precision, and recall in comparison with other state-of-the-art methods in the literature.