Deep Fingerprinting: Undermining Website Fingerprinting Defenses with Deep Learning
Open accessAbstract
Website fingerprinting enables a local eavesdropper to determine which websites a user is visiting over an encrypted connection. State-of-the-art website fingerprinting attacks have been shown to be effective even against Tor. Recently, lightweight website fingerprinting defenses for Tor have been proposed that substantially degrade existing attacks: WTF-PAD and Walkie-Talkie. In this work, we present Deep Fingerprinting (DF), a new website fingerprinting attack against Tor that leverages a type of deep learning called Convolutional Neural Networks (CNN) with a sophisticated architecture design, and we evaluate this attack against WTF-PAD and Walkie-Talkie. The DF attack attains over 98% accuracy on Tor traffic without defenses, better than all prior attacks, and it is also the only attack that is effective against WTF-PAD with over 90% accuracy. Walkie-Talkie remains effective, holding the attack to just 49.7% accuracy. In the more realistic open-world setting, our attack remains effective, with 0.99 precision and 0.94 recall on undefended traffic. Against traffic defended with WTF-PAD in this setting, the attack still can get 0.96 precision and 0.68 recall. These findings highlight the need for effective defenses that protect against this new attack and that could be deployed in Tor.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Deep Residual Learning for Image Recognition
He, K., Zhang, X., Ren, S., & Sun, J. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.90 · Cited by 235,474 · see citing works
ImageNet classification with deep convolutional neural networks
Krizhevsky, A., Sutskever, I., & Hinton, G. E. (2017) · Communications of the ACM · doi:10.1145/3065386 · Cited by 112,155 · see citing works
LeCun, Y., Bengio, Y., & Hinton, G. (2015) · Nature · doi:10.1038/nature14539 · Cited by 84,126 · see citing works
Gradient-based learning applied to document recognition
Lecun, Y., Bottou, L., Bengio, Y., & Haffner, P. (1998) · Proceedings of the IEEE · doi:10.1109/5.726791 · Cited by 58,805 · see citing works
Going deeper with convolutions
Szegedy, C., Liu, W., Jia, Y., Sermanet, P., Reed, S., Anguelov, D., Erhan, D., Vanhoucke, V., & Rabinovich, A. (2015) · 2015 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2015.7298594 · Cited by 48,562 · see citing works
(2014) · Cited by 33,419 · see citing works
GAN（Generative Adversarial Nets）
淳司, 柴. (2017) · Journal of Japan Society for Fuzzy Theory and Intelligent Informatics · doi:10.3156/jsoft.29.5_177_2 · Cited by 19,268 · see citing works
Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate ShiftPreprint
Ioffe, S. (2024) · arXiv (Cornell University) · doi:10.57702/o9raffed · Cited by 15,273 · see citing works
Towards Evaluating the Robustness of Neural Networks
Carlini, N., & Wagner, D. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.49 · Cited by 8,859 · see citing works
Learning long-term dependencies with gradient descent is difficult
Bengio, Y., Simard, P., & Frasconi, P. (1994) · IEEE Transactions on Neural Networks · doi:10.1109/72.279181 · Cited by 8,542 · see citing works
(2010) · Journal of Machine Learning Research · doi:10.5555/1756006.1953039 · Cited by 4,051 · see citing works
Convergence Results for Neural Networks via Electrodynamics
Panigrahy, R., Rahimi, A., Sachdeva, S., et al. (2018) · Leibniz international proceedings in informatics · doi:10.4230/lipics.itcs.2018.22 · Cited by 2,848 · see citing works
Proceedings of the 26th International Conference on Neural Information Processing Systems
Burges, C. J. C., Bottou, L., Welling, M., Zoubin Ghahramani, A., & Weinberger, K. Q. (2013) · Cited by 1,323 · see citing works
Website Fingerprinting at Internet Scale
Panchenko, A., Lanze, F., Zinnen, A., Henze, M., Pennekamp, J., Wehrle, K., & Engel, T. (2016) · Proceedings 2016 Network and Distributed System Security Symposium · doi:10.14722/ndss.2016.23477 · Cited by 645 · see citing works
Website fingerprinting in onion routing based anonymization networks
Panchenko, A., Niessen, L., Zinnen, A., & Engel, T. (2011) · ACM Workshop on Privacy in the Electronic Society (WPES) · doi:10.1145/2046556.2046570 · Cited by 508 · see citing works
Peek-a-Boo, I Still See You: Why Efficient Traffic Analysis Countermeasures Fail
Dyer, K. P., Coull, S. E., Ristenpart, T., & Shrimpton, T. (2012) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2012.28 · Cited by 478 · see citing works
Herrmann, D., Wendolsky, R., & Federrath, H. (2009) · doi:10.1145/1655008.1655013 · Cited by 423 · see citing works
Cai, X., Zhang, X. C., Joshi, B., & Johnson, R. (2012) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/2382196.2382260 · Cited by 394 · see citing works
Statistical identification of encrypted Web browsing traffic
Sun, Q., Simon, D. R., Wang, Y.-M., Russell, W., Padmanabhan, V. N., & Qiu, L. (2005) · Proceedings 2002 IEEE Symposium on Security and Privacy · doi:10.1109/secpri.2002.1004359 · Cited by 377 · see citing works
A Critical Evaluation of Website Fingerprinting Attacks
Juarez, M., Afroz, S., Acar, G., Diaz, C., & Greenstadt, R. (2014) · Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2660267.2660368 · Cited by 327 · see citing works
Self-citationSystematic evaluation of convolution neural network advances on the Imagenet
Mishkin, D., Sergievskiy, N., & Matas, J. (2017) · Computer Vision and Image Understanding · doi:10.1016/j.cviu.2017.05.007 · Cited by 316 · see citing works
Improved website fingerprinting on Tor
Wang, T., & Goldberg, I. (2013) · ACM Workshop on Privacy in the Electronic Society (WPES) · doi:10.1145/2517840.2517851 · Cited by 305 · see citing works
A Systematic Approach to Developing and Evaluating Website Fingerprinting Defenses
Cai, X., Nithyanand, R., Wang, T., Johnson, R., & Goldberg, I. (2014) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/2660267.2660362 · Cited by 296 · see citing works
Toward an Efficient Website Fingerprinting Defense
Juarez, M., Imani, M., Perry, M., Díaz, C., & Wright, M. (2016) · Lecture notes in computer science · doi:10.1007/978-3-319-45744-4_2 · Cited by 289 · see citing works
Self-citationTiming Analysis in Low-Latency Mix Networks: Attacks and Defenses
Shmatikov, V., & Wang, M.-H. (2006) · Lecture notes in computer science · doi:10.1007/11863908_2 · Cited by 281 · see citing works
On Realistically Attacking Tor with Website Fingerprinting
Wang, T., & Goldberg, I. (2016) · Proceedings on Privacy Enhancing Technologies · doi:10.1515/popets-2016-0027 · Cited by 170 · see citing works
Cai, X., Nithyanand, R., & Johnson, R. (2014) · Workshop on Privacy in the Electronic Society · doi:10.1145/2665943.2665949 · Cited by 166 · see citing works
Walkie-talkie: an efficient defense against passive website fingerprinting attacks
Wang, T., & Goldberg, I. (2017) · Rare & Special e-Zone (The Hong Kong University of Science and Technology) · Cited by 115 · see citing works
Var-CNN and DynaFlow: Improved Attacks and Defenses for Website Fingerprinting.
Bhat, S., Lu, D., Kwon, A. H., et al. (2018) · Cited by 13 · see citing works
p-FP: Extraction, Classification, and Prediction of Website Fingerprints with Deep LearningPreprint
Oh, S. E., Sunkam, S., & Hopper, N. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1711.03656 · Cited by 12 · see citing works
Flagged first, then by citations
Research works printed but not linked: 9
- [6]6. Xiang Cai, Rishab Nithyanand, and Rob Johnson. 2014. CS-BuFLO: A congestion sensitive website fingerprinting defense. In Workshop on Privacy in the Electronic Society (WPES). ACM, 121-130.
- [11]11. Djork-Arné Clevert, Thomas Unterthiner, and Sepp Hochreiter. 2015. Fast and accurate deep networks learning by exponential linear units (ELUs). In in the International Conference on Computer Vision (ICCV15)).
- [13]13. Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde- Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. 2014. Genera- tive adversarial nets. In Advances in Neural Information Processing Systems 27, Z. Ghahramani, M. Welling, C. Cortes, N. D. Lawrence, and K. Q. Wein- berger (Eds.). Curran Associates, Inc., 2672-2680. http://papers.nips.cc/paper/ 5423-generative-adversarial-nets.pdf
- [14]14. Jamie Hayes and George Danezis. 2016. k-fingerprinting: A robust scalable website fingerprinting technique. In USENIX Security Symposium. USENIX Asso- ciation, 1-17.
- [17]17. Andrew Hintz. 2003. Fingerprinting websites using traffic analysis. In Privacy Enhancing Technologies (PETs). Springer, 171-178.
- [26]26. Dmytro Mishkin, Nikolay Sergievskiy, and Jiri Matas. 2016. Systematic evaluation of CNN advances on the ImageNet. CoRR abs/1606.02228 (2016). · arXiv
- [32]32. Vera Rimmer, Davy Preuveneers, Marc Juarez, Tom Van Goethem, and Wouter Joosen. 2018. Automated Website Fingerprinting through Deep Learning. In Proceedings of the 25nd Network and Distributed System Security Symposium (NDSS 2018). Internet Society.
- [33]33. Roei Schuster, Vitaly Shmatikov, and Eran Tromer. 2017. Beauty and the Burst: Remote identification of encrypted video streams. In USENIX Security Symposium. USENIX Association, 1357-1374.
- [39]39. Tao Wang, Xiang Cai, Rishab Nithyanand, Rob Johnson, and Ian Goldberg. 2014. Effective attacks and provable defenses for website fingerprinting. In USENIX Security Symposium. USENIX Association, 143-157.
Cited by
Sorted by citations
Lin, X., Xiong, G., Gou, G., Li, Z., Shi, J., & Yu, J. (2022) · Proceedings of the ACM Web Conference 2022 · doi:10.1145/3485447.3512217 · Cited by 599 · see citing works
Shen, M., Zhang, J., Zhu, L., Xu, K., & Du, X. (2021) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2021.3050608 · Cited by 392 · see citing works
Wang, K., Zhang, J., Bai, G., Ko, R., & Dong, J. S. (2021) · Proceedings of the Web Conference 2021 · doi:10.1145/3442381.3450008 · Cited by 27 · see citing works
Lightweight Identification of Malicious IoT Traffic via Cross-View Knowledge Distillation
Nie, F., Liu, W., Liu, G., Gao, B., Huang, J., & Yuen, C. (2025) · IEEE Internet of Things Journal · doi:10.1109/jiot.2025.3596167 · Cited by 1 · see citing works
- Authors
- Sirinam, P., Imani, M., Juarez, M., & Wright, M.
- Affiliations
- Rochester Institute of Technology (US)
- The University of Texas at Arlington (US)
- IMEC (BE)
- Venue
- Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security
- Publisher
- ACM
- Published
- 2018-10-15
- Pages
- 1928-1943
- ISSN
- 1543-7221 (ISSN-L)
- OpenAlex
- W2963704216
- Cited by
- 592
- References
- 30
- Citations by year
- 2026: 99 · 2025: 129 · 2024: 105 · 2023: 83 · 2022: 64 · 2021: 58 · 2020: 33 · 2019: 16 · 2018: 5
- FWCI
- 11.43
- Type
- conference paper
- Language
- en
- Open access
- bronze
- doi.org
- Locations
- ACM SIGSAC Conference on Computer and Communications Security (CCS) (publishedVersion)
- Funders
- National Science Foundation (CNS-1423163 and CNS-1722743)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Social Sciences › Sociology and Political Science › Privacy, Security, and Data Protection
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Keywords
- website fingerprinting, Tor, encrypted traffic analysis, convolutional neural networks, deep learning attacks, walkie-talkie
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
