A robust multi-label website fingerprint defense method based on hybrid deep learning

Abstract

The present invention discloses a robust multi-label website fingerprint defense method based on hybrid deep learning, belonging to the field of network security technology. The present invention comprises two stages: reconstructing input sequences and constructing an anonymous sequence model. In the first stage, some overlapping virtual packet traces are first generated to the trainer adversary, making the trainer adversary familiar with the multi-tab overlapping traffic and website identities, thereby reducing the adversary's accuracy. Then, LSTM (long short-term memory) autoencoder technology is designed to effectively reconstruct the overlapping input sequences in the multi-tab interface and separate the overlapping regions. In the second stage, bidirectional long short-term memory (Bi-LSTM) is applied to anonymize the traffic sequence to blur the sequential pattern of user interactions. At the same time, adversarial examples are added during the training process to further improve the robustness of the method.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a robust multi-label website fingerprint defense method based on hybrid deep learning. Background Art

[0002] Website fingerprinting (WF) is a traffic analysis method used when browsing the internet. It primarily focuses on monitoring and analyzing user browser communication patterns between websites and users. Using deep learning classifiers, an adversary can achieve the highest accuracy. The attacker first listens to and tracks packet traces from multiple websites, likely visited by the user. The attacker then uses traffic analysis tools to capture packet traces from different websites. The key technology behind website fingerprinting attacks involves sophisticated traffic analysis techniques, typically leveraging machine learning and deep learning algorithms to classify relevant and distinct features, such as packet timing, packet size, inter-packet intervals, and packet sequences, to create fingerprints for different websites. Therefore, with the increasing internet usage in our daily lives, we are concerned that these website fingerprinting attacks could compromise our security and privacy. To ensure browser security and privacy, different defense methods have been designed based on the specific situation. When such methods confuse the adversary and create obstacles to their attack mechanisms, they are considered defensive techniques.

[0003] Website fingerprinting defense mechanisms employ various manipulation techniques, two of which are fundamental: adding dummy packets and delaying real packets. Both mechanisms should have low bandwidth overhead and latency to ensure effective system integration. Consequently, several existing WF defense methods exist: constant-rate padding, supersequence, WTF-PAD, application-level, and adversarial example-based. Constant-rate padding involves transmitting or sending packet traffic simultaneously, maintaining a constant flow in both directions from client to server and server to client, to obfuscate trace signatures. This continuous packet generation is terminated after the page load is complete and a minimum time has elapsed. Supersequence clustering groups websites into anonymity sets, with each cluster represented by a corresponding sequence containing all traffic sequences. Traces are then padded to their supersequences based on the cluster. WTF-PAD attempts to ensure this delay by sending bursts of dummy packets, introducing significant delays in the inter-packet arrival times between packets. However, this defense technique does not add any latency to the traffic. Application-level defenses operate on the target website's web server. It alters the size distribution of each content type (PNG, HTML, CSS) to match the profile of common onion sites, sometimes adding random delays to HTTP requests and manipulating HTTP request and response patterns to influence the order of packets. Adversarial example methodologies related to defense rely on creating adversarial examples—modifying samples from one category so that they are misclassified as belonging to another. The size of the modification is limited. These methods possess three key properties that make them suitable for WF defense: robust misclassification, small perturbations, and transferability. Tor is another encrypted traffic network designed to protect user privacy. It is a low-latency anonymity network supported by volunteer nodes that relay traffic for Tor clients. Another type of WF defense can be derived based on the label classification of different websites. These are single-tab and multi-tab WF defenses. Most researchers defending this approach have focused on single-tab websites, but this assumption is incorrect because users almost exclusively browse a single website during a browsing session. This means that single-tab website fingerprinting is a technique that tracks a user's browsing activity by analyzing the unique characteristics of their web browser or device. In the single-tab scenario, attackers attempt to identify a user's online behavior based on the specific attributes of the websites they visit, even if they only have one tab open in their browser. Multi-tab website fingerprinting refers to the process of identifying and tracking users by analyzing traffic patterns across multiple tabs or websites. Today, attackers are more actively targeting these multi-tab websites, so specialized defense techniques are needed to secure them. Until now, no specialized defenses have been developed to confuse adversaries targeting multi-tab website traffic. The most challenging aspect of multi-tab website defense is accounting for the overlap between multiple websites open simultaneously.In order to solve the above problems, the present invention proposes a robust multi-label website fingerprint defense method based on hybrid deep learning. Summary of the Invention

[0004] The purpose of the present invention is to provide a robust multi-label website fingerprint defense method based on hybrid deep learning to solve the problems raised in the background technology.

[0005] In order to achieve the above object, the present invention adopts the following technical solutions:

[0006] A robust multi-label website fingerprint defense method based on hybrid deep learning includes two stages: reconstructing the input sequence and building an anonymous sequence model. Specifically, it includes the following:

[0007] S1. Reconstruct the input sequence:

[0008] S1.1. Design a pre-processing module to generate overlapping virtual packet traces to the trainer adversary, making the trainer familiar with multi-tab overlapping traffic and website identities, thereby reducing the adversary's accuracy. This design reduces bandwidth overhead to ensure security against attack methods.

[0009] S1.2. Using long short-term memory (LSTM) autoencoder technology to remove specific information from the packet sequence, the adversary is confused between the information of the multi-tab traffic behavior being analyzed;

[0010] S2. Build an anonymous sequence model:

[0011] S2.1, apply bidirectional long short-term memory (LSTM) to anonymize traffic sequences to obfuscate the sequential patterns of user interactions;

[0012] S2.2. Enhance the training process model with adversarial examples and add an extra layer of encryption.

[0013] Preferably, the overlapping virtual data packets described in S1.1 are only injected in the first few seconds of each trace and do not extend to the overall trace of the multi-tab trace. Most of the real overlapping traces occur during this period, and the browser generates multiple browsings. When the most useful features of the network fingerprint (WF) classification occur, the most useful features are corresponding during the main browsing session; the overlapping virtual data packets are added in a highly random manner to ensure that different traces of different websites differ in total length, packet order and packet direction; the above randomness makes it difficult for the adversary to find meaningful patterns and identify the real overlapping traces identified by the website.

[0014] Preferably, the S1.2 specifically includes the following contents:

[0015] S1.2.1, the defender injects the overlapping virtual data packets generated in S1.1;

[0016] S1.2.2,generating real overlapping data packets from a multi-tab browsing session;

[0017] S1.2.3. Specific packet information is deleted through the long short-term memory (LSTM) autoencoder to create a complex situation for the attacker and increase the difficulty of the attack.

[0018] Preferably, the bidirectional long short-term memory (Bi-LSTM) is used to capture forward and backward dependencies on traffic sequences, thereby understanding the context of each network event.

[0019] Preferably, after the model training is completed, the performance of the model is evaluated on a separate test set using accuracy, precision, recall and F1 score indicators to obtain its effectiveness in identifying a single website in a multi-tab scenario.

[0020] Preferably, the anonymous sequence model constructed in S2 is actually a defense mechanism, specifically including: adding overlapping pseudo-data packets on the onion router (Tor) as a shielding process of mixed data as a defense mechanism to enhance privacy and mitigate website fingerprint attacks; dividing groups without meaning and feature information into pseudo-packets, which only generate noise in the packet sequence; the pseudo-packets are overlapping pseudo-packets, and after adding pseudo-packets to ensure another level of encryption to confuse the opponent in a higher order, adversarial examples are further added, and the examples introduce periodic traffic bursts for each label from a multi-label website instead of a continuous stream; the frequency and intensity of the adversarial examples are different, making it difficult to distinguish different tab feature mechanisms.

[0021] Compared with the existing technology, the present invention provides a robust multi-label website fingerprint defense method based on hybrid deep learning, which has the following beneficial effects:

[0022] (1) The present invention proposes a hybrid website fingerprint defense (HWFD), which is a hybrid model composed of deep learning technology. It is a defense mechanism in multi-tab browsing scenarios and analyzes the complete multi-trajectory in the browsing session. The present invention proposes a robust multi-tab website fingerprint defense method based on hybrid deep learning, which points out the limitations of protecting multiple websites when the browser browses multiple websites at the same time and the limited strength of existing website fingerprint defense methods, and can solve the attack problem of multi-tab websites. Compared with the existing multi-tab website defense methods on the market, the defense method proposed by the present invention is more robust, lower cost, and has low recognition bandwidth overhead, and there is no delay overhead in the present invention.

[0023] (2) The present invention applies Bi-LSTM sequence modeling technology and uses adversarial examples to enhance the training process to analyze and blur sequence patterns. The above technology competes with adversarial training by randomly moving in the mixed trajectory space, which can effectively reduce the accuracy of the attack method; in extensive experiments, the LSTM autoencoder technology successfully reconstructed inputs with higher time overhead and the adversary was confused by three times the complexity; and the bidirectional long short-term memory (Bi-LSTM) applied by the present invention can accurately anonymize the sequence and achieve a lower bandwidth level, which is far superior to other WF defense methods and the first designer of multi-label WF defense. The integration of the above components also greatly enhances the accuracy and robustness of WF defense in multi-tab scenarios, can be integrated into more complex neural network architectures, allows flexibility in model design and optimization, and can learn from the limitations of previous implementations of WF defense on anonymous technologies such as Tor. It has the characteristics of no delay overhead, low data and bandwidth overhead and easy implementation. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 This is the overall flow chart of a robust multi-label website fingerprint defense method based on hybrid deep learning proposed by the present invention;

[0025] Figure 2 This is a schematic diagram of the principle of injecting overlapping virtual data packets into the threat model mentioned in Example 1 of the present invention;

[0026] Figure 3 Schematic diagram of the principle of generating adversarial examples mentioned in Example 1 of the present invention. DETAILED DESCRIPTION

[0027] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments.

[0028] Example 1:

[0029] See also Figure 1 ,This paper proposes a robust multi-label website fingerprint ,defense method based on hybrid deep learning, which mainly includes two stages: ,reconstructing input and sequence anonymization.

[0030] For the first phase, the present invention first generates some overlapping virtual packet traces for the trainer adversary, who is already familiar with the multi-tab overlapping traffic and website identities, and reduces the adversary's accuracy. This design ensures low bandwidth overhead to ensure security against the attack method. Then, LSTM (Long Short-Term Memory) autoencoder technology is designed to effectively reconstruct the overlapping input sequences within the multi-tab interface and separate the overlapping areas. During the reconstruction process, some specific traffic patterns will be removed to make it difficult for the adversary to handle this situation. Specifically, it includes the following:

[0031] Preprocessing: This invention generates a number of obfuscated, overlapping pseudo packets. These dummy packets are injected within the first few seconds of each trace because the first few seconds are crucial in generating multi-tab website traces. Most truly overlapping traces occur during this time, with browsers primarily generating multiple browsing sessions during the first portion. This is when the most useful features for WF classification occur, corresponding to these primary browsing sessions. Most of the best attack techniques use this primary browsing session for classification. Therefore, this invention addresses this technique by first injecting a number of overlapping pseudo packets to confuse the adversary and delay transmission. This invention only injects these overlapping pseudo packets in the first portion; they do not extend throughout the entire multi-tab trace. These packets are added in a highly randomized manner, ensuring that traces from different websites appear distinct in terms of overall length, packet order, and packet direction. This randomness makes it difficult for an adversary to find meaningful patterns and identify genuine overlapping traces identified by the website.

[0032] Reconstruction of the input phase:

[0033] This invention uses LSTM autoencoder technology to remove certain information from packet sequences, confusing the adversary with the information about the multi-tab traffic behavior they are analyzing. In this step, the challenge facing the adversary is threefold. First, the defender injects previously overlapping virtual packets, then generates real overlapping packets from a multi-tab browsing session, and finally, removes certain packet information through the LSTM autoencoder, creating a complex situation for the attacker. See [1]. Figure 2 , Figure 2The overall architecture of this multi-tab website fingerprinting defense method is highlighted. Using deep learning to perform multi-tab website fingerprinting in Tor is an intriguing research task, but simultaneously addressing all the challenges is complex. Multi-tab website fingerprinting refers to the ability to distinguish which websites a user is visiting based on network traffic analysis when multiple tabs are open. Deep learning, particularly neural networks, has been applied to improve the accuracy of website fingerprinting attacks, making them more sophisticated and potentially more effective. These architectures greatly facilitate the decomposition or reconstruction of inputs using autoencoder techniques. Bidirectional information flow is challenging because it involves analyzing and processing complex and potentially noisy data. When implementing a long short-term memory (LSTM) model in Python, the present invention makes several important choices regarding the model's architecture and hyperparameters. These choices can significantly impact the model's performance and behavior. LSTM autoencoders are capable of learning hierarchical representations of sequential data. By training the LSTM autoencoder, the present invention can automatically extract relevant features and capture complex patterns embedded in the data, making it relatively easy to reconstruct the input sequence based on the decoder's analysis. The latent space representation learned by the LSTM autoencoder effectively compresses high-dimensional input data into a lower-dimensional latent space. This dimensionality reduction helps discover salient features and reduces the computational complexity of subsequent processing steps. LSTM autoencoders can detect anomalies or deviations from normal traffic patterns. The autoencoder can identify unusual segments in overlapping traffic that correspond to different websites, allowing the model to isolate them.

[0034] For the second stage, we apply Bi-LSTM (Bi-LSTM) to anonymize traffic sequences to obscure the sequential patterns of user interactions. To add another layer of encryption, we add adversarial examples to the training process. We further propose a robust defense method that can compete not only with this new attack method, but also with other previous single-label and multi-label attack methods. Specifically, it includes the following:

[0035] Building an anonymous sequence model: Defenders will anonymize sequences of real traffic patterns by obfuscating the sequential patterns of user interactions. Bi-LSTMs can capture both forward and backward dependencies, enabling them to understand the context of each network event. When making predictions, they consider not only past events but also future ones. Therefore, anonymizing the entire sequence with this approach is highly advantageous.

[0036] Model training: The training process model is enhanced by adversarial examples, adding an extra layer of encryption to make the generation of adversarial traces more reliable and effective, which can create complexity for the adversary to classify in an adversarial training environment. The ultimate goal is to generate untargeted adversarial traces that make the classifier mark the traffic traces, which helps it identify the website and its source. The present invention uses a variety of targets identified by the Bi-LSTM procedure. In order to protect a given trace, the source website and its associated traffic traces, the present invention first generates a set of potential target traces selected from the sequence of the previous stage. Then, it randomly selects one of the traces as a test sample and gradually changes the training sample to make it closer to the test sample. The process stops when the classifier determines that the category of the test sample has been changed or anonymized. The goal is to generate an untargeted adversarial trace. The amount of changes applied to the sample measures the bandwidth overhead. See Figure 3 , Figure 3 It highlights how adversarial examples can be added to the training procedure to enhance the technique.

[0037] In summary, the present invention first adds overlapping pseudo packets to Tor as a shielding process for mixed data as a defense mechanism, which is an effective strategy for enhancing privacy and mitigating website fingerprinting attacks. The present invention divides packets without meaning and characteristic information into pseudo packets, which simply generates noise in the packet sequence. Previous researchers have also used pseudo packets in their work, but in the present invention, the pseudo packets are different because they will be overlapping pseudo packets instead of normal pseudo packets. After adding pseudo packets to ensure another level of encryption to confuse the adversary at a higher order, the present invention adds adversarial examples that introduce periodic traffic bursts for each label from a multi-label website instead of a continuous stream. The frequency and strength of such adversarial examples can vary, making it difficult to distinguish between different tab characterization mechanisms.

[0038] Example 2:

[0039] Based on Example 1, but different in that, the present invention proposes a robust multi-label website fingerprint defense method based on hybrid deep learning, which specifically includes the following contents.

[0040] Phase 1: Reconstruction of the input sequence

[0041] Step 1: Inject overlapping dummy packets:

[0042] Overlapping is a defensive technique used in the Tor network to enhance privacy protection and reduce the effectiveness of website fingerprinting attacks by masking underlying traffic patterns. The overlapping pseudo-packets are different from the overlapping traces used in the attack mechanism. First, the packet structure of the pseudo-packets is determined, with the primary focus on making the pseudo-packets appear identical to the actual packet sequence to mislead potential adversaries. Then, payload data is generated for the pseudo-packets. This payload data can be randomly generated or predefined to simulate different types of network traffic, such as encrypted data. Finally, the pseudo-packets are included in the real traffic stream at predefined intervals. This injection distorts the patterns in the network traffic, making it more difficult for adversaries to extract meaningful information about user browsing behavior.

[0043] Step 2: LSTM autoencoder technology is used to remove specific and important information through encoder and decoder:

[0044] Combining LSTMs and autoencoders to reconstruct input sequence points is challenging. Using LSTM memory cells, the encoder scheme preserves the correlation between multiple data points in the time series while maintaining high dimensionality reduction. The decoder LSTM uses the reconstruction error rate to set a threshold for reproducing a fixed-size input sequence from the reduced representation of the input data in the latent space. This threshold is used to remove specific details from the trace. The autoencoder attempts to encode the input data with high-level feature information about the input data (later stored in a latent space vector). Based on this latent space vector, the decoder begins decoding the vector feature information and attempts to recreate an output sequence similar to the input data. The discriminator generates samples from the decoder output and input of the actual patch area. Since the input is only a sequence of cells injected with overlapping pseudo-packets, rather than a complete network trace, the training complexity is lower, but the data complexity is higher for the adversary. The present invention organizes LSTM layers to process the data sequence, with each LSTM layer processing a sequence and capturing temporal correlations. Multiple LSTM layers are designed to capture more complex patterns. The output layer is designed appropriately for the specific task. To determine which information in the input sequence needs to be changed, a low-dimensional decoder is used. The present invention generalizes and anonymizes traffic patterns by encoding network traffic data into a latent space and then decoding it. The autoencoder reconstructs the input while removing specific details that can be used for fingerprint identification. This will bring challenges and complexities to the adversary.

[0045] Phase 2: Sequence Anonymity

[0046] Step 1: Apply Bidirectional Long Short-Term Memory (Bi-LSTM) to identify trajectories to perform adversarial examples:

[0047] Fingerprinting multi-label websites differs significantly from previous research that used deep learning methods but did not incorporate these specific architectures. This combination of architectures distinguishes this work from previous research in the field of deep learning-based website fingerprinting. This paper describes how to utilize a Bi-LSTM, detailing how the activation functions of the LSTM unit and other layers in the model affect the ability to capture model nonlinearities. Larger batch sizes may lead to faster convergence but also require more memory. Smaller batch sizes provide more stable training. Learning rate decay is used to adjust the learning rate during training. This paper selects the number of training epochs (iterations over the entire dataset) and monitors validation loss to determine and implement early stopping based on validation loss to prevent continued training when the model begins to overfit. Within the overall model architecture, the Bi-LSTM captures forward and backward temporal dependencies, enabling it to better understand the context of encoded regions. This paper also trains the Bi-LSTM model to anonymize sequences of network traffic data representing user browsing activity. It learns to obfuscate sequential patterns of user interactions with websites, making it difficult for adversaries to infer browsing behavior. Adversarial examples are added to the model during training. After training, the model's performance was evaluated on a separate test set using metrics such as accuracy, precision, recall, and F1 score to assess its effectiveness in identifying individual websites in a multi-tabbed scenario. The Bi-LSTM layer captures contextual information from past and future time steps, which is crucial for recognizing sequential patterns and later anonymizing them. The forward layer processes the input sequence from left to right, capturing forward dependencies, while the backward layer does the reverse. The present invention trains the Bi-LSTM model to reconstruct the input sequence while maintaining privacy and anonymity using techniques from the first-stage LSTM autoencoder or adversarial training during training to encourage the model to generate plausible sequences that deviate from recognizable patterns. Regularization techniques such as dropout, L2 regularization, and batch normalization are applied to prevent overfitting and improve generalization. If initial deep learning results are unsatisfactory, hyperparameter tuning is performed to optimize model performance. This involves adjusting parameters such as the number of LSTM units, dropout rate, learning rate, batch size, and number of training epochs.

[0048] Step 2: Augment the training process with adversarial examples:

[0049] The training process is enhanced using adversarial examples, or attacks against the Bi-LSTM model's ability to recognize browsing patterns. By exposing the model to adversarial stimuli during training, the present invention enhances its robustness and resilience against real-world attacks, which aims to move training samples towards test samples and only uses the detector network to estimate the confidence that the trajectory is misclassified. Through the above design, the shape of the detector network is effectively reduced, and it helps to generate adversarial trajectories that are more robust to adversarial training. The adversarial trajectory generation process requires multiple iterations of generation. However, since the method is performed under the Bi-LSTM method, the forward and backward dependencies of the method ensure lower bandwidth and shorter latency for generating adversarial examples.

[0050] The above description is only a preferred specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any technician familiar with the technical field, within the technical scope disclosed by the present invention, who makes equivalent replacements or changes based on the technical solution and inventive concept of the present invention, should be covered by the scope of protection of the present invention.

Claims

1. A robust multi-label website fingerprint defense method based on hybrid deep learning, characterized by: It includes two stages: reconstructing the input sequence and building an anonymous sequence model, specifically including the following: S1. Reconstruct the input sequence: S1.

1. Design a pre-processing module to generate overlapping virtual packet traces to the trainer adversary, making the trainer familiar with multi-tab overlapping traffic and website identities to reduce the accuracy of the adversary; S1.2, using long short-term memory autoencoder technology to remove some specific information from the packet sequence, making the adversary confused between the information of the multi-tab traffic behavior being analyzed; S2. Build an anonymous sequence model: S2.1, apply bidirectional long short-term memory to anonymize traffic sequences to obfuscate the sequential patterns of user interactions; S2.

2. Enhance the training process model with adversarial examples and add an extra layer of encryption.

2. A robust multi-label website fingerprint defense method based on hybrid deep learning according to claim 1, characterized in that: The overlapping virtual data packets described in S1.1 are only injected in the first few seconds of each trace and do not extend to the overall trace of the multi-tab trace; the overlapping virtual data packets are added in a highly random manner to ensure that different traces of different websites have differences in total length, packet order and packet direction.

3. A robust multi-label website fingerprint defense method based on hybrid deep learning according to claim 1, characterized in that: S1.2 specifically includes the following: S1.2.1, the defender injects the overlapping virtual data packets generated in S1.1; S1.2.2,generating real overlapping data packets from a multi-tab browsing session; S1.2.

3. Specific packet information is deleted through the long short-term memory autoencoder to create a complex situation for the attacker and increase the difficulty of the attack.

4. A robust multi-label website fingerprint defense method based on hybrid deep learning according to claim 1, characterized in that: The bidirectional long short-term memory is used to capture forward and backward dependencies on traffic sequences, thereby understanding the context of each network event.

5. The robust multi-label website fingerprint defense method based on hybrid deep learning according to claim 1 is characterized in that: After the model training is completed, the performance of the model is evaluated on a separate test set using accuracy, precision, recall, and F1 score metrics to obtain its effectiveness in identifying a single website in a multi-tab scenario.

Images