Source-linked AI summary
Tik-Tok: The Utility of Packet Timing in Website Fingerprinting Attacks
Mohammad Saidur Rahman, Payap Sirinam, Nate Mathews, Kantha Girish Gangadhara, Matthew Wright
TL;DR
The paper examines whether noisy packet timing remains useful for website fingerprinting against Tor users. It introduces burst-level timing features, evaluates raw and directional timing in deep-learning attacks, and finds that directional timing usually performs best while timing features provide distinct information. The study also identifies practical limits from how defenses are implemented and from its local passive threat model.
Problem
Packet timing has often been discounted in WF because low-level timing is volatile, leaving its usefulness for identifying Tor websites insufficiently examined.
Method
The paper develops burst-level timing features, analyzes their information leakage, and evaluates raw and directional timing representations in a Deep Fingerprinting attack.
Results
Directional timing performs better than direction-only or timing-only inputs in most closed-world settings, while timing features are relatively distinct and support classifier robustness.
Takeaways & Limitations
WF defenses should pay more attention to burst-level timing because timing is another fingerprintable traffic attribute and can improve attacks when combined with direction.
Takeaways & Limitations
The evaluation assumes a local passive adversary, and practical burst-molding implementation can reduce inter-burst and intra-burst timing variance, lessening timing’s value.
Abstract
from arXiv · showhide
A passive local eavesdropper can leverage Website Fingerprinting (WF) to deanonymize the web browsing activity of Tor users. The value of timing information to WF has often been discounted in recent works due to the volatility of low-level timing information. In this paper, we more carefully examine the extent to which packet timing can be used to facilitate WF attacks. We first propose a new set of timing-related features based on burst-level characteristics to further identify more ways that timing patterns could be used by classifiers to identify sites. Then we evaluate the effectiveness of both raw timing and directional timing which is a combination of raw timing and direction in a deep-learning-based WF attack. Our closed-world evaluation shows that directional timing performs best in most of the settings we explored, achieving: (i) 98.4% in undefended Tor traffic; (ii) 93.5% on WTF-PAD traffic, several points higher than when only directional information is used; and (iii) 64.7% against onion sites, 12% higher than using only direction. Further evaluations in the open-world setting show small increases in both precision (+2%) and recall (+6%) with directional-timing on WTF-PAD traffic. To further investigate the value of timing information, we perform an information leakage analysis on our proposed handcrafted features. Our results show that while timing features leak less information than directional features, the information contained in each feature is mutually exclusive to one another and can thus improve the robustness of a classifier.
1 Introduction
Website fingerprinting can identify Tor users’ visited sites from encrypted traffic, while packet timing has often been discounted because of noise. This paper develops burst-level timing features and evaluates timing combined with direction for WF attacks.
- Motivation: Up to 98% accuracy has been reported for WF attacks that classify encrypted Tor traffic using features such as packet statistics and burst patterns.
- Motivation: Bursts group consecutive packets traveling in the same direction, making burst patterns a central target of WF defenses.
- Motivation: Timing has received less attention because bandwidth variation and other factors introduce substantial noise into packet timing.
- Contributions: The paper develops new burst-level timing features and compares them with prior handcrafted features using information leakage analysis.
- Contributions: Tik-Tok combines timing with packet direction for the Deep Fingerprinting attack and reduces WTF-PAD classification error from 9% to 6.5%.In the open-world WTF-PAD setting, precision and recall improve to 0.979 and 0.745 when tuned for precision.
- Contributions: The study finds burst-level timing effective for WF attacks and argues that defenses should treat timing as another fingerprintable traffic attribute.
2 Threat Model
The threat model assumes a local, passive adversary observing encrypted client-to-guard traffic without modifying or decrypting it. WF classifiers are trained on monitored websites and evaluated in closed- or open-world settings.
- Adversary capabilities: The attacker is local and can access encrypted streams between the client and the Tor guard, including through wireless, ISP, or intervening networks.
- Adversary capabilities: The attacker is passive: she records encrypted traffic but cannot delay, drop, or modify packets, and cannot decrypt the traffic.
- Attack procedure: Training uses repeated Tor visits to selected sites, extracts features from each trace, and fits a classifier that predicts the visited website from matching features.
- Evaluation settings: Because collecting samples for every website is infeasible, the classifier uses a monitored set, while all other websites comprise the unmonitored set.
- Evaluation settings: Closed-world evaluation restricts visits to monitored sites, whereas open-world evaluation allows visits to both monitored and unmonitored sites.
3 Background and Related Work
Prior WF attacks used hand-crafted traffic features or deep learning, while timing information was often limited, omitted, or considered less useful. This work extends evaluation to burst-level timing, timing-direction combinations, onion sites, and modern defenses.
- Hand-crafted WF attacks use engineered traffic features, while deep-learning attacks increasingly automate feature extraction.Prior work includes k-NN, SVM, random forests, SDAE, CNN, LSTM, and DF approaches.
- Timing was largely absent from many strong attacks, despite earlier evidence that aggregate timing statistics could help classify sites.The k-FP attack found packets-per-second statistics moderately helpful, while several benchmark attacks omitted timing.
- The paper introduces burst-based timing features and histograms to capture broader statistical profiles than prior timing summaries.The authors compare their handcrafted features with prior approaches using the WeFDE information-leakage framework.
- Deep Fingerprinting achieved 98% closed-world accuracy with direction-only data and over 90% against WTF-PAD.It also achieved 49.7% accuracy and 98.4% top-2 accuracy against Walkie-Talkie.
- The paper evaluates timing-aware attacks against WTF-PAD, Walkie-Talkie, and onion sites, including deep-learning attacks with and without timing.The onion-site study is presented as the first evaluation of more powerful deep-learning attacks in that setting.
- Fixed-rate padding hides timing patterns but imposes 100% to 300% bandwidth and latency overheads, so it is excluded from evaluation.The paper instead focuses on defenses considered more practical for Tor deployment.
4 Representing Timing Information
The paper represents timing through burst-level features, histogram-based normalization, raw timestamps, and directional timing. These representations are designed to capture timing patterns while combining timing with packet direction for classification.
- Burst-Level Features: The proposed timing features use traffic bursts because low-level timing features vary across instances, while bursts provide more consistent information.The feature set includes within-burst timing, inter-burst delays, and statistics over consecutive bursts.
- Burst-Level Features: Eight burst-level features measure packet timing within bursts or relationships between consecutive bursts.Examples include median packet time, variance, burst length, and inter-burst delays such as IBD-FF and IBD-LF.
- Burst-Level Features: IBD-FF measures the interval between the first packets of consecutive bursts, while IBD-LF measures the interval from one burst’s last packet to the next burst’s first packet.For B1 and B2, the examples are 0.40 and 0.20, respectively.
- Histogram Construction: Histograms convert raw timing features into robust representations by using global distributions and equal-item bins.Each instance is mapped into histograms whose bin ranges come from the global distributions and whose values are normalized from 0 to 1.
- Histogram Construction: The bin count trades detail against stability: larger b gives finer features but may be less stable, whereas smaller b gives more consistency but less discrimination.The experiments select b = 20 for all datasets.
- Timing Representations: Raw timing uses a 1D vector of packet timestamps with maximum length 5000, padding shorter traces with zeroes.This representation separates timing information from directional information.
- Timing Representations: Directional timing multiplies each packet timestamp by its direction, and its use in the DF classifier is called the Tik-Tok attack.Outgoing packets use +1 and incoming packets use −1 in the directional representation.
5 Datasets
The evaluation uses existing undefended, defended, and onion-site datasets, while also constructing a live-Tor Walkie-Talkie dataset to address unrealistic simulated timestamps and pairing assumptions.
- The study uses datasets for undefended Tor, WTF-PAD, Walkie-Talkie, and onion sites from prior work.The number of sites and instances for each dataset is reported in Table 2.
- Real-world Walkie-Talkie: Simulated Walkie-Talkie timestamps for padding packets are arbitrary and unlikely to represent real-world behavior.The authors therefore caution that timing-based attack performance on that dataset is unlikely to be accurate.
- Real-world Walkie-Talkie: The authors collect a real-world Walkie-Talkie dataset over the live Tor network using burst molding on private Tor bridges.It contains 100 sensitive sites paired randomly with 10,000 nonsensitive sites.
- Real-world Walkie-Talkie: Randomized pairings produce a dataset in which each site instance represents a different sensitive–nonsensitive pairing.This avoids statically pairing sensitive sites with only one nonsensitive site and better reflects the intended attack scenario.
6 Experimental Evaluation
The evaluation shows that burst-level timing features provide classification value, while deep learning can extract substantial fingerprinting information from raw and directional timing across defended and undefended Tor traffic. Directional timing generally performs best, and timing features add complementary information despite low individual leakage and redundancy.
- Burst-Level Features: 60.7% accuracy was reached by SVM using MED, IMD, and Burst Length with b = 20 bins on undefended Tor traffic.
- Burst-Level Features: 84.3% accuracy was attained by the deep-learning attack using the combined burst-level timing features on undefended Tor traffic.The features were evaluated with the DF model alongside other deep-learning attacks.
- Information Leakage: Only 40 of 310 timing features were redundant, while the Packets per Second category had 6.56 bits of joint leakage.The highest leakage for a new feature was 5.43 bits for MED, and low redundancy increased combined leakage estimates.
- Feature Complementarity: Combining the proposed features with k-FP features improved DF accuracy by 2% on the undefended dataset but produced no noticeable improvement with RF.The result indicates that the features capture different but related timing information.
- Raw Timing: 96% accuracy was achieved with raw timing on the Undefended dataset, compared with 86% on WTF-PAD and 73% on simulated W-T traffic.Onion Sites produced over 50% improvement over the handcrafted timing-feature results.
- Directional Timing: 93.4% accuracy was attained against WTF-PAD with directional time, exceeding both direction-only and raw-timing representations.On Onion Sites, directional time was 12% higher than direction-only information; simulated W-T reached 97% accuracy.
- Open World: 0.99 precision and 0.94 recall were achieved with direction and directional time on undefended data when tuned for precision.On WTF-PAD, directional time outperformed direction, with timing improving monitored-versus-unmonitored classification.
7 Discussion
The discussion attributes WTF-PAD’s timing vulnerability to unchanged timestamps of real bursts, while practical W-T implementation compromises reduce timing leakage. These findings distinguish simulated-defense results from real-world behavior.
- WTF-PAD Defense: WTF-PAD leaves timestamps of real bursts unaffected by zero-delay adaptive padding, allowing classifiers to distinguish real from fake bursts.Leakage decreases for most feature groups, but Packets per Second and categories such as MED retain useful information.
- W-T Defense: W-T’s practical implementation virtually eliminates inter-burst timing variance and reduces intra-burst timing variance, significantly lessening timing information.The simulated setting instead preserves substantial timing information because burst molding does not alter real-packet timestamps.
- W-T Defense: Directional information is leaked by the practical W-T implementation, improving the performance of direction-based attacks against the prototype.
8 Conclusion
The paper establishes timing as a useful source of website-fingerprinting information on Tor and introduces burst-level features and directional timing for deep-learning attacks. Across settings, directional timing improves performance over direction alone, including realistic open-world evaluation.
- Contributions: Eight burst-level timing features provide meaningful classification power across noisy instances and show low redundancy with previously studied timing features.
- Raw Timing: 96% accuracy was achieved using only timestamps on the Undefended dataset, despite ignoring packet direction.
- Directional Timing: Directional timing was 12% more accurate than direction alone on Onion Sites and improved performance over direction or timing in most closed-world settings.Directional timing is formed by taking the product of timing and direction data.
- Open World: 0.99 precision and 0.95 recall were attained with directional timing on undefended traffic in the open-world setting.Against WTF-PAD, the attack reached 0.98 precision and 0.75 recall, described as modest improvements over directional information alone.
- Implications: Timing features are another fingerprintable traffic attribute that WF defenses need to consider when evaluating information leakage.The paper notes that timing can affect defenses in difficult-to-predict ways.
A W-T Data Collection
The authors built a full W-T prototype as a Tor pluggable transport to evaluate padding with realistic timestamp information. The prototype runs at the client and guard node, but guard placement creates a security limitation.
- Prototype Design: The W-T prototype addresses the lack of realistic dummy-packet timestamps in the original defense simulator by implementing the defense specification for Tor traffic.
- Prototype Design: The prototype implements W-T as a Tor Pluggable Transport module based on WFPadTools, deployed on both the client and guard node.It is intended for use with the Tor Browser Bundle and the half-duplex patch used in prior evaluation.
- Deployment Limitation: The guard-node deployment is vulnerable to a malicious guard node because the prototype prioritizes evaluating the padding mechanism.A practical deployment would ideally use the middle node, but that requires direct Tor network-code implementation rather than a pluggable transport.
A.1 W-T Dataset
The authors built a realistic Walkie-Talkie dataset using a Tor prototype, diverse monitored and unmonitored sites, and implementation choices designed to reproduce burst padding in practice.
- The defense pairs websites and pads packet sequences so paired sites appear identical in packet-level structure.
- The crawl used 100 monitored sites and 10,000 sampled unmonitored sites to model varied attacker pairings.
- The dataset was collected with a modified Tor Browser Crawler using a prototype deployed as Tor guards on Amazon Web Services.
- The implementation identifies bursts through half-duplex communication, allowing only one side to send at a time.
- Packets are queued until a burst ends, enabling accurate dummy-packet counts and nearly identical inter-burst timing.
- Fake bursts are appended after real communication when the real burst sequence is shorter than the decoy sequence.
B.1 Limitations of the Implementation
The W-T implementation has practical limitations involving burst detection, communication overhead, padding constraints, and the placement of fake bursts, each of which can expose traffic differences.
- Burst Identification: Burst-detection errors can segment traffic incorrectly, causing the trailing portion to receive less padding than intended.
- Overheads: Packet overhead averaged 2.21 ± 1.22 times the original sequence, while time overhead averaged 10.13 ± 6.48 times.
- Padding: The scheme can add dummy packets but cannot remove real packets, so oversized bursts may fail to match smaller target bursts.
- Padding: Such unmatched bursts inevitably leak information that classifiers can use to distinguish real and decoy sites.
- Tail Padding: Appending fake bursts at the end can let attackers identify and remove them, retaining only the suspected real traffic.
C W-T Experimental Results
Experiments with realistic W-T traffic found that implementation imperfections expose fingerprints and make the defense weaker than its claimed guarantee, although W-T remained less accurate to attack than WTF-PAD.
- W-T was weaker in practice than its claimed 50% maximum attacker-accuracy guarantee because traffic could not be perfectly manipulated.
- Earlier simulated datasets permitted strict supersequence construction without ordinary burst variation, network effects, or Tor-node processing time.
- Realistic prototype crawls exposed instance-to-instance trace changes that produced unexpected burst sequences detectable by the DF classifier.
- W-T still produced lower classification accuracy than WTF-PAD against the authors’ attacks, making supersequence padding appear more desirable.
- The authors conclude that simulated padding can provide an initial estimate, but defenses should be experimentally evaluated before confident design judgments.
D Open World Challenge of W-T
Open-world W-T deployment faces unresolved challenges in site pairing, attacker knowledge, persistent mappings, and the practical management of required trace databases.
- W-T must be tested against attacker-selected monitored sets containing sensitive sites, nonsensitive sites, or mixtures of both.
- Pairing is difficult because users may differ in which sites they consider sensitive, and random pairing can produce weak decoys.
- A real site and its decoy must retain the same pairing across visits, or attackers may infer the relationship from changing pairings.
- Local mappings risk recording browsing activity, whereas pairing every possible site in advance would require an enormous site list.
- The pairing and trace-database issues remain major problems before W-T can be realistically studied in the open world or deployed.