Source-linked AI summary
FlowAtom: Atom-Based Evidence Aggregation for Multi-Label Website Fingerprinting
Chongru Fan, Wentao Huang, Wei Wang, Zhenquan Ding, Jinqiao Shi, Wei Cai, Zhiyu Hao
TL;DR
Mixed encrypted traffic makes website-set identification difficult because an individual flow may provide only partial evidence of website identity. FlowAtom constructs shared Atoms without website labels and pools their responses across flows for window-level prediction. It achieves the highest micro-F1 among evaluated methods in all reported closed- and open-world settings.
Problem
Mixed traffic can contain overlapping visits and similar flows, while an individual flow may provide only partial evidence of website identity.
Source: §1 · p. 1Method
Results
FlowAtom achieves the highest micro-F1 among evaluated methods in all 15 closed-world and 30 open-world settings.
Source: §4.2 · p. 3, §4.3 · p. 3, §5 · p. 4Takeaways & Limitations
The flow-level approach predicts monitored website sets without requiring visit-level packet trace segmentation or flow-to-website assignment at inference.
Source: §5 · p. 4The threat model is limited to distinguishable connections in Direct HTTPS and non-multiplexed encrypted proxy settings, with a passive attacker unable to decrypt or modify traffic.
Source: §2 · p. 2
Abstract
from arXiv · showhide
Identifying the set of monitored websites in mixed encrypted traffic is challenging because an individual flow often provides only partial evidence of website identity. To address this challenge, we propose FlowAtom, which constructs shared prototypes, called Atoms, from flow representations without website labels. Specifically, FlowAtom pretrains a flow encoder on external unlabeled traffic and aggregates Atom responses across flows within each observation window into a fixed-dimensional, permutation-invariant representation for monitored website-set prediction. Across Direct HTTPS, Trojan, and VMess, FlowAtom achieves micro-F1 scores of 97.82%, 94.43%, and 93.92% in closed-world evaluation, respectively, and consistently outperforms the evaluated baselines in open-world evaluation on windows containing monitored visits. The code is available at https://github.com/aimafan123/FlowAtom.
1. INTRODUCTION
FlowAtom addresses website-set identification in mixed traffic by combining complementary evidence across flows, rather than relying on an individual flow to identify a website. It builds label-free shared Atoms and pools their responses for window-level prediction.
1. INTRODUCTION
- The flow-level approach takes an unordered flow set per window and predicts the monitored website set without visit-level packet trace segmentation or flow-to-website assignment at inference.The evaluation windows are constructed offline from pre-segmented visit traces.Source: §1 · p. 1
- Different websites can produce similar flows, so an individual flow may provide only partial identity evidence that is distributed across flows in an observation window.Multi-tab browsing can also combine overlapping visits with background and unmonitored traffic, motivating prediction of a website set.Source: §1 · p. 1, Figure 1 · p. 1
- FlowAtom clusters flow representations without website labels into shared Atoms, then max-pools Atom responses across flows into a fixed-dimensional, permutation-invariant window representation.The resulting representation is used to predict the monitored website set.Source: §1 · p. 2
- FlowAtom reports closed-world micro-F1 scores of 97.82%, 94.43%, and 93.92% and open-world scores of 92.37%, 92.64%, and 89.85% across Direct HTTPS, Trojan, and VMess, respectively.The benchmark includes Direct HTTPS and non-multiplexed encrypted proxies.Source: §1 · p. 2
2. THREAT MODEL
The threat model covers passive observation of distinguishable connections in Direct HTTPS and non-multiplexed encrypted proxy settings. The model receives unordered flows, not visit boundaries or flow-to-website assignments.
2. THREAT MODEL
- The attacker observes traffic on the client egress link for Direct HTTPS and on the client–proxy link for encrypted proxy settings.The attacker is passive and cannot decrypt or modify traffic.Source: §2 · p. 2
- The attacker separates flows using five-tuples or equivalent connection identifiers and observes packet payload lengths and directions.The model input excludes IP addresses, DNS information, and SNI.Source: §2 · p. 2
- The model receives an unordered flow set without website-visit boundaries or flow-to-website assignments, but the attacker must still separate flows by connection.The model does not require packet-level trace segmentation by visit.Source: §2 · p. 2
3. METHOD
FlowAtom pretrains and freezes a flow encoder, constructs shared Atoms from unlabeled target-scenario training flows, then pools Atom responses across flows to predict website labels for each window.
3. METHOD
- Flow pretraining encodes signed packet payload-length sequences from external unlabeled traffic using MoCo-style contrastive learning, after which the encoder is frozen.Zero-payload packets are removed, and sequences are truncated or padded to 300 positions.Source: §3 · p. 2
- For each target scenario, FlowAtom clusters frozen-encoder representations from its training split without website labels; retained cluster centers define shared Atoms.An XGBoost mapper learns cluster-assignment pseudo-labels and produces each flow’s Atom response vector; the encoder and mapper remain frozen for inference.Source: §3 · pp. 2–3
- Each offline window combines valid flows from one visit trace per selected website, and max pooling each Atom’s response across those flows yields an A-dimensional, order-invariant representation.Flows are instances, each window is a bag, and its monitored websites form the label set.Source: §3 · p. 3
- A two-hidden-layer MLP learns window-level website labels from standardized representations while the encoder and mapper remain frozen.Training uses binary crossentropy with positive-class weighting, and validation selects the model and decision thresholds.Source: §3 · p. 3
4. EVALUATION
The evaluation tests mixed-flow windows across Direct HTTPS, Trojan, and VMess, comparing FlowAtom with five baselines. FlowAtom leads in all tested closed- and open-world settings, while ablations examine K and the number of retained flows.
4.1. Evaluation Setup
- Evaluation uses 1,000,000 JP-MAWI unlabeled flows, 100 Tranco monitored sites, and offline mixed-flow windows with m = 1–5 monitored sites.Methods share data splits, constructed windows, and metrics; each task reports mean micro-F1 across five random-seed runs.Source: §4.1 · p. 3
4.2. Closed-World Experiments
- 4.64–16.70 percentage points: FlowAtom beats the strongest baseline across all 15 closed-world settings spanning m = 1 and m ∈ {2, 3, 4, 5}.Table 1 reports closed-world micro-F1 (%) across three traffic scenarios and monitored-website counts.Source: §4.2 · p. 3, Table 1 · p. 4
4.3. Open-World Experiments
- 30 combinations: FlowAtom achieves the highest micro-F1 in every open-world case across three scenarios, two monitored-website conditions, and five values of b.All evaluated windows contain monitored visits; Fig. 3 separates m = 1 from pooled m ∈ {2, 3, 4, 5}.Source: §4.3 · p. 3, Figure 3 · p. 4
4.4. Ablation Experiments
- Micro-F1 generally increases with K across all three traffic scenarios, then plateaus with small fluctuations at larger values.Fig. 4 examines the effect of K under Direct HTTPS, Trojan, and VMess.Source: Figure 4 · p. 4, §4.4 · p. 4
- 32.16%, 37.31%, and 36.24%: micro-F1 when one flow is retained per visit trace under Direct HTTPS, Trojan, and VMess, respectively.Micro-F1 increases as more flows are retained per visit trace.Source: Figure 5 · p. 4, §4.4 · p. 4
5. CONCLUSION
FlowAtom predicts monitored website sets from unordered flow sets without packet-level visit segmentation or flow-to-website assignment at inference. It leads the evaluated methods in every tested closed- and open-world setting.
5. CONCLUSION
- FlowAtom uses unordered flow sets to predict monitored website sets without packet-level visit segmentation or flow-to-website assignment at inference.Max pooling Atom responses across flows produces a fixed-dimensional, permutation-invariant window representation.Source: §5 · p. 4
- FlowAtom learns flow representations from external unlabeled traffic and constructs shared Atoms from each target scenario’s training flows.Max pooling each Atom’s responses across flows yields the window representation for prediction.Source: §5 · p. 4
- FlowAtom achieves the highest micro-F1 among evaluated methods in all 15 closed-world and 30 open-world settings tested across Direct HTTPS, Trojan, and VMess.Source: §5 · p. 4