User Behavior Identification via Traffic Analysis in Web 3.0

With the rise of Web 3.0, developers are gradually releasing more and more decentralized applications (DApps) on blockchain platforms such as Ethereum. Analyzing the resulting network traffic allows for the identification of users’ visits to specific DApps, thereby revealing sensitive information such as their personal status, economic power, social circles, and political leanings. The similarity in communication interfaces and traffic encryption settings among DApps on the same platform makes it challenging to differentiate their traffic. Existing methods for encrypted traffic classification either rely on manually designed features or have low detection accuracies. Thus, accurately and efficiently conducting DApp fingerprinting in Web 3.0 scenarios remains a significant challenge. In this chapter, we propose GraphDApp, a novel Web 3.0 application fingerprinting recognition method that utilizes Graph Neural Networks (GNNs). In order to be able to represent the rich information of encrypted DApp flows, we introduce a graph structure called the Traffic Interaction Graph (TIG). TIG preserves the bidirectional multidimensional nature of client–server interactions. By formulating Web 3.0 application fingerprinting as a graph classification problem, we design a GNN-based classifier. To evaluate our approach, we collect a real-world traffic dataset of 1300 Dapps in Web 3.0 scenarios, comprising over 169,000 flows. Experimental results demonstrate that GraphDApp outperforms the latest methods in classification accuracy in both closed- and open-world scenarios. Furthermore, GraphDApp also has high accuracy in traditional mobile application classification tasks.