Website Fingerprinting at Internet Scale
Open accessAbstract
The website fingerprinting attack aims to identify the content (i.e., a webpage accessed by a client) of encrypted and anonymized connections by observing patterns of data flows such as packet size and direction.This attack can be performed by a local passive eavesdropper -one of the weakest adversaries in the attacker model of anonymization networks such as Tor.In this paper, we present a novel website fingerprinting attack.Based on a simple and comprehensible idea, our approach outperforms all state-of-the-art methods in terms of classification accuracy while being computationally dramatically more efficient.In order to evaluate the severity of the website fingerprinting attack in reality, we collected the most representative dataset that has ever been built, where we avoid simplified assumptions made in the related work regarding selection and type of webpages and the size of the universe.Using this data, we explore the practical limits of website fingerprinting at Internet scale.Although our novel approach is by orders of magnitude computationally more efficient and superior in terms of detection accuracy, for the first time we show that no existing method -including our own -scales when applied in realistic settings.With our analysis, we explore neglected aspects of the attack and investigate the realistic probability of success for different strategies a real-world adversary may follow.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Statistical-feature-based encrypted traffic classification methods rely on expert-designed features that are hard to design generically and have limited generalization ability.
“These methods highly rely on expert-designed features and have limited generalization ability.”
From ET-BERT: A Contextualized Datagram Representation with Pre-training Transformers for Encrypted Traffic Classification (2022) · cites this paper as [27]
Section VI says an earlier website-fingerprinting classifier used a large set of manually selected features, supporting the expert-designed-features part. In “Optimizing Feature Sampling” (page unavailable), the paper warns that further tuning to particular websites could make features less generalizable; it does not establish that these methods generally have limited generalization ability or that generic features are hard to design. (LLM, conf=0.85)
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
LIBSVM: A library for support vector machines
Chang, C.-C., & Lin, C.-J. (2011) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/1961189.1961199 · Cited by 40,918 · see citing works
Libsvm : A library for support vector machines
Ferrari, V. (2008) · Medical Entomology and Zoology · Cited by 10,124 · see citing works
A Practical Guide to Support Vector Classication
Hsu, C., Chang, C.-C., & Lin, C. (2008) · Cited by 5,070 · see citing works
Tor: The Second-Generation Onion Router
Dingledine, R., Mathewson, N., & Syverson, P. (2004) · doi:10.21236/ada465464 · Cited by 4,104 · see citing works
Website fingerprinting in onion routing based anonymization networks
Panchenko, A., Niessen, L., Zinnen, A., & Engel, T. (2011) · ACM Workshop on Privacy in the Electronic Society (WPES) · doi:10.1145/2046556.2046570 · Cited by 508 · see citing works
Self-citationPeek-a-Boo, I Still See You: Why Efficient Traffic Analysis Countermeasures Fail
Dyer, K. P., Coull, S. E., Ristenpart, T., & Shrimpton, T. (2012) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2012.28 · Cited by 478 · see citing works
Herrmann, D., Wendolsky, R., & Federrath, H. (2009) · doi:10.1145/1655008.1655013 · Cited by 423 · see citing works
Inferring the source of encrypted HTTP connections
Liberatore, M., & Levine, B. N. (2006) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/1180405.1180437 · Cited by 421 · see citing works
Cai, X., Zhang, X. C., Joshi, B., & Johnson, R. (2012) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/2382196.2382260 · Cited by 394 · see citing works
Web MIXes: A System for Anonymous and Unobservable Internet Access
Berthold, O., Federrath, H., & Köpsell, S. (2001) · Lecture notes in computer science · doi:10.1007/3-540-44702-4_7 · Cited by 377 · see citing works
Statistical identification of encrypted Web browsing traffic
Sun, Q., Simon, D. R., Wang, Y.-M., Russell, W., Padmanabhan, V. N., & Qiu, L. (2005) · Proceedings 2002 IEEE Symposium on Security and Privacy · doi:10.1109/secpri.2002.1004359 · Cited by 377 · see citing works
Analysis of the SSL 3.0 protocol
Wagner, D. A., & Schneier, B. (1996) · Cited by 351 · see citing works
Effective attacks and provable defenses for website fingerprinting
Wang, T., Cai, X., Nithyanand, R., Johnson, R., & Goldberg, I. (2014) · Cited by 338 · see citing works
A Critical Evaluation of Website Fingerprinting Attacks
Juarez, M., Afroz, S., Acar, G., Diaz, C., & Greenstadt, R. (2014) · Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2660267.2660368 · Cited by 327 · see citing works
Improved website fingerprinting on Tor
Wang, T., & Goldberg, I. (2013) · ACM Workshop on Privacy in the Electronic Society (WPES) · doi:10.1145/2517840.2517851 · Cited by 305 · see citing works
A Systematic Approach to Developing and Evaluating Website Fingerprinting Defenses
Cai, X., Nithyanand, R., Wang, T., Johnson, R., & Goldberg, I. (2014) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/2660267.2660362 · Cited by 296 · see citing works
Traffic Morphing: An Efficient Defense Against Statistical Traffic Analysis
Wright, C. V., Coull, S. E., & Monrose, F. (2009) · Cited by 281 · see citing works
Fingerprinting Websites Using Traffic Analysis
Hintz, A. S. (2003) · Lecture notes in computer science · doi:10.1007/3-540-36467-6_13 · Cited by 273 · see citing works
Privacy Vulnerabilities in Encrypted HTTP Streams
Bissias, G. D., Liberatore, M., Jensen, D. D., et al. (2006) · Lecture notes in computer science · doi:10.1007/11767831_1 · Cited by 229 · see citing works
Spot Me if You Can: Uncovering Spoken Phrases in Encrypted VoIP Conversations
Wright, C. V., Ballard, L., Coull, S. E., Monrose, F., & Masson, G. M. (2008) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2008.21 · Cited by 219 · see citing works
On Realistically Attacking Tor with Website Fingerprinting
Wang, T., & Goldberg, I. (2016) · Proceedings on Privacy Enhancing Technologies · doi:10.1515/popets-2016-0027 · Cited by 170 · see citing works
Language identification of encrypted VoIP traffic: Alejandra y Roberto or Alice and Bob?
Wright, C. V., Ballard, L., Monrose, F., & Masson, G. M. (2007) · Cited by 151 · see citing works
HTTPOS: Sealing Information Leaks with Browser-side Obfuscation of Encrypted Flows.
Luo, X., Zhou, P., Chan, E. W. W., Lee, W., Chang, R. K. C., & Perdisci, R. (2011) · Cited by 140 · see citing works
Website Fingerprinting and Identification Using Ordered Feature Sequences
Lu, L., Chang, E., & Chan, M. C. (2010) · Lecture notes in computer science · doi:10.1007/978-3-642-15497-3_13 · Cited by 126 · see citing works
Circuit fingerprinting attacks: passive deanonymization of tor hidden services
Kwon, A., AlSabah, M., Lazar, D., Daciér, M., & Devadas, S. (2015) · USENIX Security Symposium · Cited by 118 · see citing works
A Case Study on Measuring Statistical Data in the Tor Anonymity Network
Loesing, K., Murdoch, S. J., & Dingledine, R. (2010) · Lecture notes in computer science · doi:10.1007/978-3-642-14992-4_19 · Cited by 94 · see citing works
Nithyanand, R., Cai, X., & Johnson, R. (2014) · Workshop on Privacy in the Electronic Society · doi:10.1145/2665943.2665950 · Cited by 92 · see citing works
Website Detection Using Remote Traffic Analysis
Gong, X., Borisov, N., Kiyavash, N., & Schear, N. (2012) · Lecture notes in computer science · doi:10.1007/978-3-642-31680-7_4 · Cited by 59 · see citing works
Probability and Statistics for Computer Scientists
Baron, M. I. (2019) · Chapman & Hall/CRC eBooks · doi:10.1201/9781315172286 · Cited by 54 · see citing works
Probability and Statistics for Computer Scientists
Baron, M. (2018) · Chapman & Hall/CRC eBooks · doi:10.1201/9781420011425 · Cited by 22 · see citing works
Walkie-Talkie: An Effective and Efficient Defense against Website Fingerprinting
Wang, T., & Goldberg, I. (2015) · Cited by 8 · see citing works
Flagged first, then by citations
Research works printed but not linked: 1
- [20]20. R. Nithyanand, X. Cai, and R. Johnson, "Glove: A bespoke website fingerprinting defense," in Proceedings of ACM WPES. Scottsdale, Arizona, USA: ACM Press, 2014.
Cited by
Sorted by citations
Deep Fingerprinting: Undermining Website Fingerprinting Defenses with Deep Learning
Sirinam, P., Imani, M., Juarez, M., & Wright, M. (2018) · Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3243734.3243768 · Cited by 592 · see citing works
Lin, X., Xiong, G., Gou, G., Li, Z., Shi, J., & Yu, J. (2022) · Proceedings of the ACM Web Conference 2022 · doi:10.1145/3485447.3512217 · Cited by 599 · see citing works
Robust Smartphone App Identification via Encrypted Network Traffic Analysis
Taylor, V. F., Spolaor, R., Conti, M., & Martinovic, I. (2018) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2017.2737970 · Cited by 439 · see citing works
“[17] present a website fingerprinting attack on Tor that outperforms related”
BackgroundShen, M., Zhang, J., Zhu, L., Xu, K., & Du, X. (2021) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2021.3050608 · Cited by 392 · see citing works
Wang, K., Zhang, J., Bai, G., Ko, R., & Dong, J. S. (2021) · Proceedings of the Web Conference 2021 · doi:10.1145/3442381.3450008 · Cited by 27 · see citing works
MT-FBERT: Malicious Traffic Detection Based on Efficient Federated Learning of BERT
Tang, J., Huang, Z., & Li, C. (2025) · Future Internet · doi:10.3390/fi17080323 · Cited by 6 · see citing works
Lightweight Identification of Malicious IoT Traffic via Cross-View Knowledge Distillation
Nie, F., Liu, W., Liu, G., Gao, B., Huang, J., & Yuen, C. (2025) · IEEE Internet of Things Journal · doi:10.1109/jiot.2025.3596167 · Cited by 1 · see citing works
- Authors
- Panchenko, A., Lanze, F., Zinnen, A., Henze, M., Pennekamp, J., Wehrle, K., & Engel, T.
- Affiliations
- University of Luxembourg (LU)
- RheinMain University of Applied Sciences (DE)
- RWTH Aachen University (DE)
- Corresponding author
- Zinnen, Andreas
- Venue
- Proceedings 2016 Network and Distributed System Security Symposium
- Publisher
- Internet Society
- Published
- 2016
- OpenAlex
- W2272516773
- Cited by
- 645
- References
- 31
- Citations by year
- 2026: 72 · 2025: 100 · 2024: 97 · 2023: 90 · 2022: 68 · 2021: 70 · 2020: 48 · 2019: 40 · 2018: 33 · 2017: 19 · 2016: 8
- FWCI
- 17.96
- Type
- conference paper
- Language
- en
- Open access
- bronze
- doi.org
- Locations
- Network and Distributed System Security Symposium (publishedVersion)
- RWTH Publications (RWTH Aachen) (publishedVersion)
- Open Repository and Bibliography (University of Luxembourg) (submittedVersion, cc-by-nc-sa)
- Funders
- Fonds National de la Recherche Luxembourg
- Horizon 2020 Framework Programme (EU‐H2020)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Social Sciences › Sociology and Political Science › Privacy, Security, and Data Protection
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Keywords
- website fingerprinting, Tor, encrypted traffic, anonymity networks, passive eavesdropping, network traffic classification, attack success probability
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
