Source-linked AI summary
CipherSight: Robust Website Fingerprinting via Record-Resource Semantic Supervision under Distribution Shifts
Runhan Song, Qiqi Liu, Chuanzhou Pan, Zhenquan Ding, Youquan Xian, Chongru Fan, Lei Cui, Wei Wang, Zhiyu Hao
TL;DR
HTTPS website fingerprinting remains vulnerable to distribution shifts, transport variability, and a gap between encrypted traffic and webpage semantics. CipherSight addresses these challenges with hierarchical TLS-record modeling and record-resource supervision, achieving 95.41% accuracy across 2,008 website classes and outperforming baselines across evaluated settings.
Problem
HTTPS website fingerprinting lacks stable, semantically informed representations that generalize across temporal, geographic, and open-world shifts.
Method
CipherSight hierarchically models ciphertext-observable TLS records within and across flows, using masked record modeling and record-resource supervision during training.
Results
95.41% accuracy across 2,008 website classes, with CipherSight consistently outperforming evaluated baselines across closed-world, temporal, geographic, and open-world evaluations.
Takeaways & Limitations
The results support TLS-record representations, explicit inter-flow modeling, and training-time resource semantics as useful for robust encrypted-traffic learning under the evaluated conditions.
Takeaways & Limitations
Privileged supervision requires SSL keys, limiting packet-only reuse, although inference remains ciphertext-only.
Abstract
from arXiv · showhide
HTTPS website fingerprinting (WF) aims to identify visited websites from metadata observable in encrypted traffic. However, real-world deployments introduce a significant out-of-distribution (OOD) problem caused by temporal and geographic changes, while previously unseen websites are common in open-world scenarios. Existing methods primarily learn from raw TCP packet sequences and struggle to capture stable and generalizable website representations, resulting in performance degradation under practical conditions. We propose CipherSight, a TLS-record-based hierarchical framework for robust HTTPS WF. Unlike existing approaches that rely on TCP packet sequences and are sensitive to transport-layer artifacts, CipherSight learns website representations from TLS records by jointly encoding multiple record-level attributes. It introduces a hierarchical architecture that captures both intra-flow dependencies among TLS records and inter-flow interactions across concurrent flows, enabling the model to exploit structural patterns in HTTPS traffic. Besides, to learn robust representations, CipherSight employs a masked record modeling (MRM) task to capture contextual traffic semantics and leverages fine-grained record-resource annotations as privileged supervision through structure-aware objectives and semantic distillation. Experiments show that CipherSight achieves 95.41% accuracy across more than 2,000 website classes in the closed-world setting and maintains over 90% accuracy under both temporal and geographic drift, consistently outperforming all evaluated baselines.
Introduction
CipherSight addresses HTTPS website fingerprinting challenges from distribution shifts, transport-layer variability, concurrent flows, and the semantic gap between encrypted traffic and webpage composition. It uses TLS-record representations, hierarchical dependency modeling, and fine-grained resource-based supervision, achieving strong closed-world, drift, and open-world results.
- Introduction: Website fingerprinting identifies visited websites from metadata observable in encrypted traffic without decrypting application payloads.It also supports studying residual information leakage and evaluating traffic-analysis defenses.
- Problem: Temporal content changes, regional routing and CDN differences, and unseen traffic make real-world HTTPS fingerprinting challenging beyond closed-world settings.The paper evaluates temporal drift, geographic drift, and open-world recognition as OOD settings.
- Problem: More than 80% of TCP packet sequences are inconsistent across observations, making packet-level representations sensitive to transport variability and hindering robust generalization.TCP segmentation, retransmissions, and dynamic network conditions can map the same website resources to substantially different packet sequences.
- Problem: Robust HTTPS representations must model both dependencies within individual flows and interactions among concurrent flows.Single-sequence methods overlook HTTPS multi-flow structure, while flow-only modeling misses webpage-loading organization across flows.
- Method: CipherSight models webpage loads at the TLS-record level and uses a hierarchical transformer to reduce transport sensitivity while preserving HTTPS flow structure.Its design includes jointly modeling multiple TLS-record attributes and explicitly separating intra-flow dependencies from inter-flow interactions.
- Results: 95.41% closed-world accuracy, 92.99% temporal-drift accuracy, and 97.64% open-world AUROC demonstrate CipherSight’s strong reported performance.It exceeds the best closed-world baseline by 13.03 pp, outperforms regional baselines by at least 8.52 pp, and maintains over 90% accuracy under geographic drift.
Related Work
Prior HTTPS website identification relied on exposed hostname or destination-IP signals, but encryption and infrastructure dynamics motivate website fingerprinting from encrypted-traffic side channels. Existing methods increasingly use higher-layer, flow-aware, or semantic representations, yet gaps remain in unified TLS-record modeling and robustness to distribution shifts.
- Direct Website Identification: Plaintext DNS, TLS SNI, and contacted destination IP addresses historically exposed website identity, but encrypted DNS, ECH, CDNs, shared hosting, load balancing, and IP churn weaken these signals.The passage describes why direct domain-to-IP identification is becoming less reliable.
- Tor-Oriented WF: Tor-oriented WF methods commonly flatten page loads into packet or cell directions, bursts, and timings for convolutional classification.Representative models include AWF, DF, and VarCNN.
- Tor-Oriented WF: Flat sequence representations transferred to HTTPS fail to explicitly preserve TLS-record boundaries and concurrent multi-flow structure.This limitation concerns structural information present in modern HTTPS page loads.
- HTTPS-Native WF: HTTPS-native methods use parallel-loading fingerprints, application data-unit lengths, inter-flow spatio-temporal correlations, or encrypted-proxy flow context, but lack unified multi-attribute TLS-record hierarchy.The cited approaches include H&W, ADU, STC-WF, and CTX-Aware.
- Semantic Supervision: Semantic WF methods align encrypted traces with crawl-time profiles or investigate resource-level distillation and semantic augmentation, whereas CipherSight uses TLS-record–resource alignment as privileged LUPI information.The distinction is the use of fine-grained alignment between TLS records and resource spans.
- Distribution Shifts: Changes in collection time, network environment, browsing context, and unmonitored traffic can substantially degrade WF performance through distribution shifts.Temporal and geographic drift alter the input distribution over monitored websites.
Method · Overview
CipherSight builds robust HTTPS website representations from TLS records through hierarchical multi-flow encoding and masked record modeling. It further uses webpage structure as privileged supervision to connect ciphertext patterns with record resources.
- Overview: CipherSight represents HTTPS traffic at the TLS-record level instead of the TCP-packet level.This design reduces sensitivity to transport-layer packetization.
- Overview: Ciphertext-observable record attributes are extracted and tokenized for model processing.
- Overview: Masked record modeling (MRM) guides CipherSight’s pretraining.
- Overview: The intra-flow encoder L1 models dependencies among records within individual flows.
- Overview: The inter-flow encoder L2 models interactions across concurrent flows in HTTPS page loads.Together, the two encoders reflect the multi-flow organization of page loads.
- Overview: CipherSight uses training-time privileged supervision to connect ciphertext patterns with webpage structure.
- Overview: Record-resource supervision (P1) is applied during pretraining to provide structure-aware webpage information.The supplied passage identifies P1 as record-resource supervision but truncates the description of its later objectives.
Representation and Hierarchical Encoding
CipherSight represents webpage-load traces as embedded TLS-record tokens and hierarchically encodes them within flows and across flows. This preserves flow boundaries while combining multi-domain connection structure for website classification.
- Representation Construction: TLS-record features combine categorical embeddings with logarithmic bucket embeddings and log-scaled linear projections, then are summed and normalized into record tokens.
- Intra-Flow Encoding: L1 encodes records within each flow using shared [FCLS] tokens, block-diagonal attention, and flow-local rotary positions.Cross-flow interaction is deferred to L2.
- Intra-Flow Encoding: The block-diagonal mask restricts self-attention to records sharing a TLS flow, producing flow summaries ui and contextual record representations hi,j.
- Inter-Flow Encoding: L2 prepends a learnable [PCLS] token to valid flow summaries and applies full self-attention to combine connections from multiple domains.
- Website Classification: The final [PCLS] hidden state becomes the student page representation hs, which a linear-GELU-dropout classifier maps to website logits os.
Pretraining with Record-Resource Supervision
CipherSight pretraining combines masked record modeling with record-resource supervision to learn contextual TLS-record representations aligned with webpage structure. MRM reconstructs masked record attributes from within-flow context, while P1 supervises aligned records and pooled resources through structure-aware objectives.
- Masked Record Modeling: MRM masks valid record embeddings and reconstructs direction, length bucket, and outer TLS content type from remaining within-flow context.The three reconstruction losses are summed as LMRM and require no resource annotations.
- Record-Resource Supervision: P1 adds training-time alignments between webpage resources and TLS records, supervising L1 at both record and resource levels.This addresses MRM’s lack of explicit record-resource correspondence.
- Record-Resource Supervision: At the record level, P1 predicts begin/inside labels and inner MIME types, while pooled aligned-record states predict resource response attributes and record counts.Unaligned records are excluded from record-level losses, and aligned states are mean-pooled for resource-level prediction.
- Joint Pretraining Objective: The pretraining objective combines MRM with resource-structure supervision through Lpre = λMRMLMRM + LP1, where LP1 weights segmentation, attribute, and count losses.LP1 = λsegLseg + λattrLattr + λcntLcnt.
- Training Scope: MRM learns dependencies among observable records, whereas P1 links hidden record states to web-resource structure while directly optimizing the tokenizer and L1.L2 is introduced later for website classification during fine-tuning.
Privileged Semantic Fine-Tuning
Privileged semantic fine-tuning preserves pretrained record representations while adapting CipherSight through low-rank updates and resource-aware supervision. A semantic teacher transfers webpage-level resource knowledge to the ciphertext student, while inference uses only TLS-record metadata and the adapted encoders and classifier.
- Backbone adaptation: CipherSight freezes the pretrained backbone and applies low-rank LoRA updates to attention projections, allowing webpage-level aggregation while limiting changes to pretrained representations.The LoRA matrices, student classifier, P1 heads, and semantic teacher remain trainable.
- Semantic teacher: The privileged semantic teacher constructs resource tokens, summarizes their semantic features, and fuses them with a stop-gradient student feature to produce teacher logits.The teacher is trained with website-label cross-entropy and transfers resource semantics through feature and logit distillation.
- Joint supervision: Continuing P1 preserves record-resource structure during adaptation, while P2 transfers webpage-level semantics from training-only resource attributes to the ciphertext student.Website-label fine-tuning alone may emphasize environment-specific correlations and weaken semantic structure learned during pretraining.
- Inference: At inference, CipherSight uses only TLS-record metadata, the L1 and L2 encoders, and the website classifier; MRM, P1, P2, and resource annotations are removed.MRM is used only during pretraining.
Evaluation
CipherSight is evaluated across closed-world, temporal-drift, geographic-drift, ablation, and open-world settings, consistently outperforming baselines while maintaining stable performance across distribution shifts. Its privileged supervision improves shifted-domain accuracy, especially geographically, and its open-world scores strengthen unknown-sample rejection.
- Closed-world evaluation: 95.41% accuracy and 94.67% macro-F1 are achieved across 2,008 closed-world website classes, exceeding VarCNN by 3.25 and 2.76 percentage points, respectively.Performance varies by less than 0.15 percentage points across five seeds.
- Temporal drift: 92.99% accuracy and 92.07% macro-F1 are achieved under a 16-day temporal drift, exceeding H&W by 13.03 and 14.15 percentage points, respectively.The accuracy margin over H&W widens from 8.96 percentage points in closed-world evaluation to 13.03 under temporal drift.
- Geographic drift: 91.09% accuracy in Singapore and 90.59% in France lead regional baselines, with only a 0.50-percentage-point difference between regions.CipherSight outperforms the strongest regional baselines by 11.56 and 8.52 percentage points, respectively, and has the smallest reported geographic degradation.
- Privileged-supervision ablation: 1.55 percentage points is the largest reported geographic accuracy gain from Full Priv. over No-Priv., compared with 0.65 under temporal drift.Under geographic drift, Full Priv. also adds 1.83 macro-F1 percentage points in France, while P1 pretraining supplies most of the temporal benefit.
- Open-world evaluation: 97.64% AUROC, 88.54% AUPR, and 94.81% OSCR are achieved in the open-world setting, exceeding RF by 4.60, 16.51, and 7.20 percentage points, respectively.The AUPR and OSCR gains indicate stronger rejection of unmonitored samples without compromising monitored-site classification.
Limitations
CipherSight’s performance may benefit from refined preprocessing and sampling, while its evaluation scope and privileged supervision impose practical limitations. Future extensions include broader temporal, client-scale, and protocol settings, although inference remains ciphertext-only.
- Potential Improvements: CipherSight may further improve through refined data preprocessing and sampling-window strategies.The passage cites Peng et al. 2025 as support for these potential improvements.
- Scope Extensions: The framework could be extended to longer-term temporal drift, larger numbers of clients, and HTTP/3 traffic.
- Deployment Constraints: Privileged supervision requires SSL keys, limiting packet-only reuse, although inference remains ciphertext-only.
Conclusion
CipherSight is a hierarchical Transformer for robust HTTPS website fingerprinting under distribution shifts, modeling TLS records within and across flows. It uses record-resource supervision and privileged semantic distillation during training while retaining ciphertext-only inference, outperforming baselines across multiple evaluation settings.
- Conclusion: CipherSight is a hierarchical Transformer that models ciphertext-observable TLS records within and across flows for robust HTTPS website fingerprinting under distribution shifts.The framework is designed around TLS-record structure rather than only individual flows.
- Conclusion: CipherSight uses record-resource supervision and privileged semantic distillation during training while preserving ciphertext-only inference.The additional supervision is used during training without requiring non-ciphertext information at inference time.
- Conclusion: CipherSight consistently outperformed the baselines across closed-world, temporal, geographic, and open-world evaluations.These settings cover both distribution shifts and open-world website fingerprinting conditions.
- Conclusion: Ablation studies showed gains from privileged supervision, particularly in the evaluated experiments.The supplied passage indicates that privileged supervision contributed to performance improvements, although the excerpt does not specify the affected setting or magnitude.