Source-linked AI summary
Robust Website Fingerprinting Through the Cache Occupancy Channel
Anatoly Shusterman, Lachlan Kang, Yarden Haskal, Yosef Meltser, Prateek Mittal, Yossi Oren, Yuval Yarom
TL;DR
Website fingerprinting can reveal sensitive browsing despite encrypted or Tor-protected traffic, motivating a cache-side-channel alternative to the classical on-path model. The paper measures cache occupancy during browser loading and rendering and classifies traces with machine learning. It finds high accuracy in closed- and open-world settings, including restrictive browsers, while showing resilience to traffic defenses and browser side-channel countermeasures.
Problem
The paper asks whether cache-based attacks can viably fingerprint websites when prior JavaScript attacks were not systematically evaluated, especially in open-world settings.
Method
The attack collects one-dimensional cache-occupancy memorygrams during browser loading and rendering, then uses deep learning to classify websites.
Results
Cache-based fingerprinting achieves results comparable with state-of-the-art network fingerprinting and outperforms it when the browser maintains cached objects, while resisting traffic molding and reduced timer resolution.
Takeaways & Limitations
Cache fingerprints combine network and rendering information, allowing the attack to remain effective when traffic is shaped or content is retrieved from the response cache.
Takeaways & Limitations
The study’s datasets are smaller than those of comparable network-fingerprinting work, limiting analysis of effectiveness and motivating larger datasets.
Abstract
from arXiv · showhide
Website fingerprinting attacks, which use statistical analysis on network traffic to compromise user privacy, have been shown to be effective even if the traffic is sent over anonymity-preserving networks such as Tor. The classical attack model used to evaluate website fingerprinting attacks assumes an on-path adversary, who can observe all traffic traveling between the user's computer and the Tor network. In this work we investigate these attacks under a different attack model, in which the adversary is capable of running a small amount of unprivileged code on the target user's computer. Under this model, the attacker can mount cache side-channel attacks, which exploit the effects of contention on the CPU's cache, to identify the website being browsed. In an important special case of this attack model, a JavaScript attack is launched when the target user visits a website controlled by the attacker. The effectiveness of this attack scenario has never been systematically analyzed, especially in the open-world model which assumes that the user is visiting a mix of both sensitive and non-sensitive sites. In this work we show that cache website fingerprinting attacks in JavaScript are highly feasible, even when they are run from highly restrictive environments, such as the Tor Browser. Specifically, we use machine learning techniques to classify traces of cache activity. Unlike prior works, which try to identify cache conflicts, our work measures the overall occupancy of the last-level cache. We show that our approach achieves high classification accuracy in both the open-world and the closed-world models. We further show that our techniques are resilient both to network-based defenses and to side-channel countermeasures introduced to modern browsers as a response to the Spectre attack.
1 Introduction
Website fingerprinting can expose sensitive browsing behavior despite Tor and encrypted traffic. This paper asks whether cache side channels, including attacks launched through malicious JavaScript, can provide a viable alternative under restrictive browser conditions.
- Monitoring online behavior can reveal sensitive information, including sexual orientation and political beliefs or affiliations.
- Encrypted traffic can still expose visited pages through metadata such as size, direction, and timing, with prior Tor fingerprinting exceeding 90% success.
- The paper studies an attacker-controlled website that monitors cache state to infer activity in other tabs or browsers on the victim’s computer.
- Cache observation may overcome traffic shaping and remain applicable when browsers retrieve websites from their response cache.
- Traditional cache attacks often require high-resolution timers, whose usefulness for website fingerprinting in browsers remained unclear.
- The central question is whether cache-based attacks are viable for website fingerprinting, especially beyond prior small closed-world demonstrations.
Our Contribution
The paper develops and evaluates JavaScript cache-occupancy fingerprinting across closed- and open-world settings. It finds high accuracy across browsers and defenses, while also examining rendering information and cache-noise mitigation.
- The JavaScript attacker achieves high fingerprinting accuracy in closed- and open-world models, including browsers with Spectre defenses and the restrictive Tor Browser.
- The attack collects cache-occupancy traces while browsers download and render websites, then classifies them with deep neural networks.
- The cache-occupancy attack requires a sampling rate six orders of magnitude lower than prior attacks by Oren et al.
- Cache-based fingerprinting remains accurate when browser response caching is enabled, unlike network-based fingerprinting, whose accuracy drops significantly.
- Cache fingerprints contain information from both network and rendering activity, helping the attack withstand constant-bit-rate traffic molding.
- A cache-noise countermeasure completely blocks the attack on Tor Browser while causing only small performance degradation on CPU-bound workloads.
2 Background
The background contrasts network-level website fingerprinting with local cache side channels. It motivates the paper’s JavaScript model by reviewing cache operation, prior browser attacks, timer constraints, and gaps in earlier evaluations.
- Tor protects users from on-path observers by forwarding encrypted traffic through collaborating relays, but traffic metadata can still support probabilistic website inference.
- Cache sharing between programs creates side channels that can leak information through contention on processor caches.
- A last-level-cache miss requires a time-consuming access to RAM, and prior browser attacks exploit cache-set structure through Prime+Probe.
- Earlier local-side-channel studies observe system properties during webpage rendering and apply machine-learning classifiers to identify the rendered website.
- The paper focuses on the modest threat model in which an attacker induces the victim to render a webpage containing malicious JavaScript.
- Modern browser mitigations make the high sampling rates used by earlier attacks unattainable, while prior work did not systematically assess open-world or antifingerprinting settings.
- Prior cache-occupancy channels relied on high-resolution timers, leaving their use against low-resolution timers unaddressed.
3 The Website Fingerprinting Attack Model
The classical model places a passive adversary on the traffic path, whereas this paper studies an attacker who injects JavaScript into one browsing context and infers sensitive activity through shared cache effects.
- In the classical model, a passive adversary monitors traffic entering and leaving the secure network while encryption and Tor routing obscure contents and destinations.
- The remote cache-based model uses malicious JavaScript injected into a browser running on the target machine.
- The attacker cannot directly inspect the sensitive session because sandboxing or process isolation separates the browsing contexts.
- In the cross-tab scenario, an attacker-controlled page infers which sensitive sites the user visits concurrently across browsers or isolated virtual machines sharing hardware.
- In the cross-network scenario, injected code on an unsecured page can infer activity over a separate VPN, Tor connection, or network adapter.
- The attack’s main challenge is an extremely restricted JavaScript runtime, requiring specially designed attacker code.
- Cache-based fingerprints can observe both network activity and browser rendering, and both contribute to classifier accuracy.
4 Data Collection
The study collects cache-occupancy traces, or memorygrams, while pages load and evaluates them across closed- and open-world website sets. It uses whole-cache measurements designed to avoid spatial and timer limitations of prior approaches.
- Trace Collection: Memorygrams record cache-access latency at a fixed sampling rate over a defined period.The trace is a vector of cache-probe measurements; missed sampling slots receive a special value.
- Cache Occupancy Channel: The cache occupancy channel measures contention across the entire last-level cache rather than specific cache sets.The attack accesses an LLC-sized buffer and observes delays caused by victim memory activity.
- Cache Occupancy Channel: The approach sacrifices spatial information because it does not reveal which cache addresses the victim accessed.This is acceptable because browser memory allocation patterns make address locations unstable across page loads.
- Trace Collection: Mainstream-browser memorygrams use 2 ms sampling for 30 seconds, producing vectors of length 15,000.Tor Browser collection instead uses 100 ms timing slots and extends probing to 50 seconds.
- Datasets: The evaluation includes closed-world datasets of 100 traces for each of 100 websites and open-world extensions with 5,000 additional non-sensitive traces.The open-world base rate is 33.3% because always predicting non-sensitive is the trivial baseline.
5 Machine Learning
The paper formulates website fingerprinting as supervised classification from labeled memorygrams to website predictions. It uses deep neural models that learn trace features automatically, with CNN and LSTM architectures evaluated under cross-validation.
- Learning Setup: Fingerprinting training builds labeled trace templates for target websites, then trains a classifier to predict labels for unseen traces.The attack phase applies the trained classifier to unlabeled traces and measures correctly assigned labels.
- Deep Learning Models: Deep learning performs automatic feature learning from raw traces, reducing reliance on manually selected features.This approach requires a sufficiently large training set to learn useful representations.
- Model Training: The neural networks use nonlinear layers to transform inputs and a softmax output layer to produce class probabilities.Training updates network weights through repeated forward propagation and backpropagation epochs.
- Deep Learning Models: The study evaluates Convolutional Neural Networks and Long Short-Term Memory networks for memorygram classification.CNNs extract patterns through convolution and pooling, while LSTMs model sequential trace information.
- Evaluation: The experiments use 10-fold cross-validation, reserving 10% of each dataset for testing and splitting the remainder into training and validation sets.The training and validation proportions are 81% and 9%, respectively.
- Model Training: The Tor Browser’s shorter traces require a modified LSTM architecture with one convolution layer and a pool size of three.The modification accommodates traces containing only 500 measurements.
6 Results
Cache-based JavaScript fingerprinting remains effective despite reduced browser timer resolutions and Spectre-related countermeasures. It achieves strong accuracy in closed- and open-world settings, with lower exact accuracy but useful top-5 performance in Tor Browser.
- Overall Results: All tested environments classify significantly better than random guessing, although Tor Browser has lower accuracy than general-purpose browsers.The result shows that restricted timer resolution does not eliminate cache-based fingerprinting.
- Timer Resolution: 80% of cache probes complete below Firefox’s 2 ms timer resolution, while none exceed Tor Browser’s 100 ms clock period.The attack therefore counts probes per Tor timing slot instead of measuring individual sweep durations.
- Closed World Results: 70–90% closed-world accuracy is achieved in mainstream browsers, while Tor Browser reaches 47% exact accuracy and 72% top-5 accuracy.The corresponding base rates are 1% for exact classification and 5% for the top-5 criterion.
- Comparison: Cache-based fingerprinting has overall accuracy comparable to reported state-of-the-art network-based methods when both attacks use the same number of traces per website.The authors expect more than 100 traces per website to improve accuracy and stability.
- Open World Results: 70–90% accuracy is also achieved in the open-world setting distinguishing 100 sensitive pages from 5,000 non-sensitive pages.The open-world base rate is 33.3%, and results are slightly better than in the closed-world setting in most cases.
- Open World Results: 83% top-5 accuracy is achieved by the Tor Browser attack in the open-world setting, compared with a 37.3% base rate.This relaxed criterion checks whether the correct website appears among the classifier’s five most probable outputs.
- Open World Results: Open-world sensitive-versus-non-sensitive classification exceeds 99% AUC in every evaluated setting.This binary analysis treats detecting the sensitive class separately from identifying the exact website.
7 Robustness Tests
The robustness tests show that cache-based fingerprinting remains effective when network traffic is cached or molded, and that it captures both network-related and rendering-related features. Its accuracy declines under temporal drift but remains useful when network-based classification fails.
- 7.2 Baseline Scenario: Native-code cache fingerprinting performs similarly to network-based fingerprinting in the baseline comparison, with stronger results than JavaScript on Firefox and Tor Browser.The native-code memorygrammer performs especially better than in-browser JavaScript against Tor Browser.
- 7.3 Enabling the Response Cache: Over 20% degradation occurs in standard network-based fingerprinting accuracy when browser response caching is enabled.Cache-based methods remain largely unaffected and retain high accuracy under the same condition.
- 7.4 Net-only and Render-only Results: With traffic molded to identical traces, network-based classification falls to random-guess accuracy, while cache-based fingerprinting remains significantly better than random guessing.The result supports resilience to network-based mitigation techniques.
- 7.4 Net-only and Render-only Results: Cache-based classification reaches about 20% without rendering activity versus 73% in the matching closed-world scenario, while remaining above the 1% random-guess baseline.The complementary experiments indicate that cache fingerprints contain features from both network traffic patterns and displayed-page contents.
- 7.5 Temporal Stability: After a 36-day interval, both cache-based and network-based classifiers lose 5–10% accuracy when trained on earlier traces.The authors state that further experiments are needed to assess temporal drift accurately.
8 Detecting Unknown Hardware Configurations
Cache-based fingerprinting must be tailored to the victim’s hardware configuration, especially the last-level cache’s set count and associativity. The paper also investigates whether JavaScript can remotely determine an unknown configuration.
- 8 Detecting Unknown Hardware Configurations: Cache-based fingerprinting requires tailoring to the victim’s last-level-cache set count and associativity, unlike largely target-agnostic network fingerprinting.Using a buffer mismatched to the hardware configuration reduces effectiveness and eventually classifier accuracy.
- 8 Detecting Unknown Hardware Configurations: Four cache configurations cover most Intel Core processor models, but the attack’s JavaScript parameters must match the target PC for effective customization.The paper tests remote configuration discovery using a 20MB array accessed in patterns intended for different cache set counts and associativities.
9 Countermeasures
The paper evaluates cache-activity masking and other cache defenses against cache-based website fingerprinting. Masking can thwart attacks under some training conditions, while cache partitioning remains promising but requires adaptation to browser settings.
- Cache Activity Masking: Spurious cache activity is proposed to mask website-rendering activity, but its effectiveness, performance impact, and power cost require further study.Initial experiments identify cache masking as promising without establishing its full effectiveness.
- Cache Activity Masking: Repeatedly evicting the entire last-level cache implements masking by accessing every line in a cache-sized buffer inside a loop.The countermeasure could be deployed in a browser, operating system, browser plugin, or security-conscious website.
- Evaluation: 1% closed-world and 33% open-world accuracy were observed when the classifier trained on unprotected traces, matching the respective base rates.With countermeasure-aware training, the attack was completely thwarted in Tor Browser, while Firefox retained some accuracy.
- Performance Impact: Around 5% geometric-mean slowdown was measured across SPEC benchmarks, with a worst-case slowdown of 14% for bwaves.The benchmark compared performance with and without the countermeasure.
- Other Countermeasures: Timer-frequency reduction and timer jitter are ineffective defenses against this cache-based fingerprinting attack.Cache randomization is also unlikely to help because the attack measures overall cache activity rather than specific cache sets.
- Other Countermeasures: Cache partitioning is promising, but browser rendering, shared cache colors, and many simultaneously open tabs complicate its deployment.Protection may require preventing multiple sites from concurrently using the same cache color.
10 Limitations and Future Work
The paper identifies limitations involving dataset scale, hardware generalization, trace synchronization, and changing or concurrent web content. These constraints motivate larger datasets and further evaluation across hardware and realistic browsing conditions.
- Scope and Datasets: The datasets are significantly smaller than those in comparable network-based fingerprinting work, limiting analysis of attack effectiveness.The authors identify larger datasets as an important direction for future research.
- Hardware Generalization: Classifiers trained on one hardware configuration may not generalize effectively to memorygrams collected on another configuration.The authors demonstrate adaptation to victim hardware but leave cross-configuration effectiveness unclear.
- Trace Synchronization: Recognizing trace starts is harder because cache activity persists before page retrieval and rendering, unlike network activity during inactive periods.The framework implicitly synchronizes traces with download starts, while network conditions can produce up to six seconds between download and rendering starts.
- Dynamic and Concurrent Content: The work shares limitations of network-based fingerprinting because websites change with time, user identity, and computer specifications.The study also generally assumes that only one website is displayed at a time.
11 Conclusions
The paper implements memorygram-based cache fingerprinting with deep learning to identify rendered websites. It reports performance comparable to state-of-the-art network fingerprinting, advantages when browser caching is present, and resilience to traffic molding and reduced timer resolution.
- Conclusions: Two memorygrammers capture browser cache activity, which deep learning uses to identify the website being displayed.The conclusion describes the core contribution as cache-side-channel website fingerprinting.
- Conclusions: Cache-based fingerprinting achieves results comparable with state-of-the-art network-based fingerprinting.This is the paper's principal cross-method performance conclusion.
- Conclusions: Cache-based fingerprinting outperforms network-based fingerprinting when the browser maintains cached objects.The comparison concerns a common operating scenario involving browser caching.
- Conclusions: The attack remains resilient to traffic molding and reduced timer resolution, including the 100 ms clock rate of Tor Browser.The former is described as a standard network-fingerprinting defense, while the latter is a countermeasure for mobile-code microarchitectural attacks.
B Websites Included in Closed-World Datasets
The closed-world dataset includes a broad collection of named websites spanning general, commercial, media, social, and technical domains. The supplied passages list the included domains without describing additional selection criteria.
- Included Websites: The dataset lists websites including 9gag.com, amazon.com, apple.com, archive.org, booking.com, facebook.com, github.com, google.com, netflix.com, and pinterest.com.These are examples from the first portion of the closed-world website list.
- Included Websites: Additional included websites include quora.com, researchgate.net, roblox.com, rt.com, scribd.com, skype.com, soundcloud.co, and microsoftonline.com.The second portion continues the named closed-world dataset entries.