Tor is an anonymous communication system designed to protect user privacy. However, Tor is still vulnerable to Website Fingerprinting (WF) attacks, which can identify the websites a user visits. Currently, most WF attack research primarily targets surface sites, and lacks specialized optimization for Tor’s onion sites, resulting in poor performance on onion sites. To address this challenge, we first propose an information-enriched traffic representation, namely the Multi-Channel Traffic Matrix (MCTM), which stacks packet direction, arrival time, and size information into a multichannel matrix, effectively extrating the information leakage in traffic traces. Secondly, we develop an effective classification model called OnionPeeler, which consists of multiple Dual-attention Enhanced Multiscale Convolutional (DAMC) modules. The DAMC modules combine multiscale convolution, feature map-wise attention mechanisms, and channel-wise attention mechanisms, allowing for flexible extraction of multi-granularity features from onion sites of different scales. We conduct extensive experiments using two versions of real-world onion site datasets, comparing OnionPeeler with the state-of-the-art (SOTA) WF attacks. The evaluation results in both closed and open-world scenarios show that OnionPeeler significantly outperforms the SOTA attacks. On the two versions of the onion site dataset, OnionPeeler leads the best existing attack by \(11.29\%\) and \(9.4\%\) in the closed-world scenario, respectively.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

OnionPeeler: A Novel Input-Enriched Website Fingerprinting Attack on Tor Onion Services

  • Zhengxin Xu,
  • Jie Cao,
  • Yujie Hou,
  • Yuwei Xu,
  • Guang Cheng

摘要

Tor is an anonymous communication system designed to protect user privacy. However, Tor is still vulnerable to Website Fingerprinting (WF) attacks, which can identify the websites a user visits. Currently, most WF attack research primarily targets surface sites, and lacks specialized optimization for Tor’s onion sites, resulting in poor performance on onion sites. To address this challenge, we first propose an information-enriched traffic representation, namely the Multi-Channel Traffic Matrix (MCTM), which stacks packet direction, arrival time, and size information into a multichannel matrix, effectively extrating the information leakage in traffic traces. Secondly, we develop an effective classification model called OnionPeeler, which consists of multiple Dual-attention Enhanced Multiscale Convolutional (DAMC) modules. The DAMC modules combine multiscale convolution, feature map-wise attention mechanisms, and channel-wise attention mechanisms, allowing for flexible extraction of multi-granularity features from onion sites of different scales. We conduct extensive experiments using two versions of real-world onion site datasets, comparing OnionPeeler with the state-of-the-art (SOTA) WF attacks. The evaluation results in both closed and open-world scenarios show that OnionPeeler significantly outperforms the SOTA attacks. On the two versions of the onion site dataset, OnionPeeler leads the best existing attack by \(11.29\%\) and \(9.4\%\) in the closed-world scenario, respectively.