PaperlayerView exact revision on arXiv

Source-linked AI summary

SCSM: A Traffic-Native Foundation Model for Transferable Website Fingerprinting

Xianwen Deng, Ruijie Zhao, Mingwei Zhan, Yijun Wang, Zhi Xue

arXiv:2610.07776v1cs.CR

TL;DR

Website fingerprinting models trained under fixed conditions can degrade when deployment traffic shifts, while existing transferable methods rely on handcrafted trace perturbations or language-oriented architectures. SCSM builds traffic-native views from unlabeled traces for contrastive pretraining, then adapts the encoder with few labeled examples. It reports gains over the strongest baselines across temporal-drift and cross-domain evaluations.

  • Problem

    Fixed-domain WF classifiers can deteriorate as website sets, collection periods, network paths, or browsers change, while existing transferable methods use handcrafted perturbations or language-centric pretraining.

    Source: §I · p. 1

  • Method

    SCSM forms structurally diverse, packet-faithful views from unlabeled traces for contrastive pretraining of a traffic-native state-space encoder, then fine-tunes it on a small labeled support set.

    Source: §I · p. 2

  • Results

    SCSM surpasses the strongest baseline by 16.4% in Accuracy@3 averaged over six GTT23 target weeks and improves macro-F1 by 13.8% on average across four cross-domain target datasets.

    Source: §I · p. 2

  • Takeaways & Limitations

    SCSM learns reusable traffic representations from unlabeled traces and supports few-shot adaptation across website sets, network conditions, and browsing scenarios.

    Source: §I · p. 2

Abstract

from arXiv · show

Website fingerprinting infers the websites visited by users from encrypted traffic metadata. However, models trained under fixed collection conditions often degrade as website sets, collection times, network paths, browsers, or defenses change. Existing transferable attacks either rely on handcrafted perturbations of individual traces or adapt language-oriented architectures to traffic, limiting their ability to capture traffic-native semantics. To address these limitations, we propose SCSM, a traffic-native foundation model for transferable website fingerprinting. Specifically, SCSM constructs pairs of pretraining views from the same group of unlabeled traces through Segmentation, Combination, Scaling, and Masking. These operations produce diverse observable patterns while preserving the underlying packet events and local traffic dynamics of real trace fragments. The corresponding windowed traffic counting matrices serve as inputs for contrastive pretraining of a state-space encoder without website annotations. The pretrained encoder is then fine-tuned on a small labeled support set, and predictions are aggregated across temporal scales at inference. Experimental results demonstrate that SCSM surpasses the strongest baselines by 16.4\% in average top-3 accuracy over six temporal-drift tasks on GTT23 and by 13.8\% in average macro-F1 over four cross-domain datasets. The code and datasets will be made available at https://github.com/SJTU-dxw/WF-SCSM.

I. INTRODUCTION

SCSM addresses the limits of fixed-domain website fingerprinting with traffic-native pretraining and few-shot adaptation. Its views preserve real trace fragments while varying traffic structure, and experiments report transfer gains across temporal and domain shifts.

I. INTRODUCTION

  • Conventional WF classifiers trained for fixed domains can deteriorate when website populations, collection periods, network paths, or browsers differ at deployment.Task-by-task learning requires repeated labeled-trace collection and classifier training, leaving shared traffic knowledge across domains unused.Source: §I · p. 1
  • Transferable WF methods using handcrafted augmentations can disrupt real directional-temporal dependencies and produce views limited to local variants of individual traces.As a result, encoders may learn invariance to designer-specified perturbations rather than transferable traffic semantics.Source: §I · p. 1
  • TraVerse adapts a pretrained language model to traffic, retaining natural-language tokenization, representation spaces, and architectural priors.SCSM instead motivates traffic-native representations that capture directional and temporal dependencies while combining event-level fidelity with structural diversity.Source: §I · p. 1
  • SCSM builds paired views from unlabeled traces through Segmentation, Combination, Scaling, and Masking, then contrastively pretrains a state-space encoder on windowed traffic counting matrices.The views preserve observed packet events and local fragment dynamics while varying global organization, temporal granularity, and visible regions; a small labeled support set adapts the encoder for downstream tasks.Source: §I · p. 2
  • 16.4% in Accuracy@3 averaged over six GTT23 target weeks and 13.8% in macro-F1 averaged across four target datasets exceed the strongest baselines.SCSM also improves average macro-F1 by 6.0% across guard-relay, website-content, and browser shifts on Swallow.Source: §I · p. 2

A. Conventional Website Fingerprinting

  • Earlier WF methods use handcrafted statistics or learned packet-direction and timing features, but are predominantly supervised on fixed domains.CUMUL, k-FP, AWF, DF, Tik-Tok, Var-CNN, TMWF, ARES, Holmes, RF, and CountMamba target distinct traffic representations or settings.Source: A. Conventional Website Fingerprinting · p. 2

B. Transfer Learning for Website Fingerprinting

The paper frames WF transfer as reuse of traffic representations across changing domains, with limited labeled adaptation. SCSM's foundation-model paradigm uses unlabeled pretraining before adapting to the target setting.

B. Transfer Learning for Website Fingerprinting

  • Labeled-source transfer methods such as TF and FMWF support few-shot adaptation, while unlabeled methods NetCLR and Swallow use traffic-specific augmentations whose invariances remain tied to predefined operations and ranges.The need to rebuild classifiers for deployment domains motivates reusable representations, while labeled-source portability depends on source-domain coverage.Source: B. Transfer Learning for Website… · p. 2

C. Foundation-Model Pretraining for WF

D. WF Defenses

  • WF defenses perturb or split traffic, altering observable packet counts, timings, or trace completeness and requiring attacks to handle defense-induced shifts.Examples include adaptive padding in WTF-PAD, randomized dummy packets in Front, transmission regularization in Tamaraw and RegulaTor [24], and circuit splitting in TrafficSliver.Source: D. WF Defenses · p. 3

A. Threat Model

  • The threat model is a local passive observer of encrypted traffic between a Tor client and its entry relay, without the ability to decrypt or modify traffic.Deployment may differ in website population, collection period, network condition, or browser configuration; adaptation may use limited labeled traces collected under a known defense.Source: A. Threat Model · p. 3

B. Foundation-Model Learning Paradigm

  • A shared traffic encoder is pretrained on unlabeled traces, then jointly adapted with a target-specific head using a small labeled support set.The limited target labels primarily establish task-specific decision boundaries rather than learning discriminative representations from scratch.Source: B. Foundation-Model Learning Paradigm · pp. 3–4

IV. SCSM

SCSM constructs diverse traffic views from trace fragments while preserving local packet dynamics, then uses contrastive pretraining and few-shot adaptation. Its traffic-native input is a windowed matrix of packet and timing features.

A. Overview

  • Two constructions from the same unlabeled source group produce structurally diverse views with shared latent website composition, which a shared state-space encoder aligns through cross-view contrastive pretraining.A linear classification head adapts the encoder on a small labeled support set, and inference averages class logits across temporal scales.Source: A. Overview · p. 4

B. Traffic-Native Input Representation

  • SCSM represents traces as direction-only windowed traffic counting matrices, adapting WTCM to preserve the temporal evolution of incoming and outgoing packets.The matrix records outgoing and incoming packet counts, gaps between nonempty windows, and packet-cluster counts based on an inter-packet-gap threshold.Source: B. Traffic-Native Input Representation · p. 4
  • The encoder input is X(x; w) = log(1+M(x; w)); making window length w explicit lets temporal Scaling vary aggregation granularity without changing underlying packet events.The window features form a 4-by-N matrix.Source: B. Traffic-Native Input Representation · p. 5

C. Traffic-Grounded Multi-Level View Construction

SCSM creates paired views from the same unlabeled trace group, preserving observed packet events while varying their global organization. Trace-level segmentation and combination supply structural diversity while retaining local packet dynamics.

C. Traffic-Grounded Multi-Level View Construction

1) Trace-Level Segmentation and Combination:

  • SCSM divides constituent traces into packet-contiguous segments, independently samples their boundaries and order, then rebases and concatenates them.The resulting reorganized traces supply fragments for subsequent inter-trace combination.Source: 1) Trace-Level Segmentation and… · p. 5
  • Each branch selects one fragment per trace and arranges the fragments with overlaps or gaps, then merges and stably sorts their packets by timestamp.A positive overlap ratio creates overlap, zero places fragments consecutively, and a negative ratio inserts a gap; local packet directions and relative timings are preserved.Source: 1) Trace-Level Segmentation and… · p. 5

2) Matrix-Level Temporal Scaling:

SCSM varies temporal aggregation without changing a composite trace’s packet events, then masks complete matrix columns. Independently randomized transformations yield paired views that retain a shared latent website composition for unlabeled contrastive pretraining.

2) Matrix-Level Temporal Scaling:

  • Increasing the sampled window length compresses the traffic pattern, while decreasing it spreads the pattern across more columns; each view remains a 4 × N direction-only WTCM.Temporal aggregation changes without modifying the underlying packet events.Source: 2) Matrix-Level Temporal Scaling · pp. 5–6

3) Feature-Level Masking:

  • SCSM randomly masks complete WTCM columns, removing temporal regions to encourage the encoder to integrate evidence across the observation horizon.Source: 3) Feature-Level Masking · p. 6
  • Independent sampling of segmentation, crop, combination, scale, and masking variables creates views with different global organization, temporal granularity, and visible regions but the same latent website composition.The paired views can be used for contrastive pretraining without website annotations.Source: 3) Feature-Level Masking · p. 6

D. State-Space Encoder and Contrastive Pretraining

SCSM uses a shared state-space encoder to map paired traffic views to embeddings and trains it with a cross-view contrastive objective. The learned representations align views from the same source group despite structural differences.

D. State-Space Encoder and Contrastive Pretraining

1) State-Space Traffic Encoding:

  • The encoder projects each WTCM window into a d-dimensional embedding, uses causal convolutional blocks with temporal max pooling, then applies Mamba2 blocks to capture temporal dependencies.The convolutional blocks reduce sequence length by a factor of six.Source: 1) State-Space Traffic Encoding · p. 6

2) View-Level Representation:

  • Averaging the encoder’s temporal outputs across positions produces one vector representation per view, used directly in the contrastive objective without a separate projection head.Source: 2) View-Level Representation · p. 6

3) Cross-View Contrastive Objective:

  • For each anchor view, the corresponding embedding from the other view is positive and the remaining embeddings in that view are negatives; the objective averages both directions.Minimizing the objective aligns views of the same source group despite differences in fragment organization, temporal granularity, and visible regions.Source: 3) Cross-View Contrastive Objective · p. 6

E. Few-Shot Adaptation

SCSM adapts a pretrained encoder using a small labeled support set and varies temporal scale during both adaptation and inference. The evaluation reuses pretrained checkpoints across temporal-drift, cross-scenario, cross-domain, open-world, defended-traffic, and multi-tab settings.

E. Few-Shot Adaptation

  • For each target task, SCSM appends a linear classification layer and adapts the model on labeled support traces using randomly sampled window lengths.This varies temporal resolution during adaptation while preserving website labels.Source: E. Few-Shot Adaptation · p. 6
  • At inference, SCSM averages logits across R equally spaced temporal scales and predicts the website with the highest averaged score.The ensemble integrates classification evidence across the scale range used during adaptation.Source: E. Few-Shot Adaptation · p. 6

V. EVALUATION

  • The evaluation reuses separate GTT23- and Swallow D1-pretrained SCSM checkpoints for temporal-drift and cross-scenario transfer, then evaluates cross-domain, open-world, and multi-tab adaptation.GTT23 adaptation uses 10 labeled traces per website in weeks 8–13; Swallow D1 transfers to D2–D7 with 10-shot adaptation, and multi-tab settings use 3,000 labeled traces total.Source: 1) Datasets · p. 7

2) Implementation Details:

The implementation uses traffic-window inputs and a state-space encoder, with shared training controls for pretraining and few-shot fine-tuning. The section also specifies comparison baselines and the metrics used across task settings.

2) Implementation Details:

  • SCSM uses 4 × N WTCMs, a 512-dimensional encoder with three Mamba2 blocks, and five-epoch GTT23 or 1,500-epoch Swallow D1 pretraining.The final fine-tuned checkpoint is evaluated at R = 5 inference scales.Source: 2) Implementation Details · p. 7

3) WF Attacks and Defenses:

  • Transferable comparisons include NetCLR, Swallow, and TraVerse; supervised comparisons include eight attacks, with six defenses considered for defended-traffic transfer.Baselines use the same pretraining data and epoch budgets where applicable, as well as shared fine-tuning and test splits, label budgets, and fine-tuning epochs.Source: 3) WF Attacks and Defenses · p. 7, 2) Implementation Details · p. 7

4) Evaluation Metrics:

  • Single-tab tasks report accuracy and macro-F1, GTT23 reports Accuracy@3, open-world DFSet uses 20-precision–recall curves, and multi-tab tasks report P@k and MAP@k.For open-world DFSet, r = 20 is the ratio of unmonitored to monitored visits; multi-tab k equals the number of tabs.Source: 4) Evaluation Metrics · p. 7

B. Temporal Drift Evaluation

SCSM is evaluated for temporal drift on GTT23 and for cross-scenario transfer on Swallow. It leads in the reported temporal and scenario comparisons, including shifts in relay location and browser.

B. Temporal Drift Evaluation

  • 16.4%: SCSM exceeds TraVerse in six-week average Accuracy@3 under independent adaptation, and has the highest Accuracy@3 in every target week.Its weekly Accuracy@3 ranges from 77.0% to 81.8%; it exceeds RF, the strongest supervised baseline, by 17.3%.Source: B. Temporal Drift Evaluation · p. 8
  • Without updates after Week 8, SCSM remains best in every target week, with Accuracy@3 falling from 80.3% in Week 8 to 67.7% in Week 13, above TraVerse’s 54.5%.The evaluation uses the Week 8 10-shot support set for all subsequent weeks without updates.Source: B. Temporal Drift Evaluation · p. 8

C. Cross-Scenario Transfer Evaluation

  • 96.6%: SCSM averages the highest accuracy across four guard-relay locations, where latency changes stretch or compress traffic patterns.Temporal Scaling varies WTCM observation granularity to emulate patterns under different network delays.Source: C. Cross-Scenario Transfer Evaluation · p. 9
  • For the D6 collection-time shift, SCSM achieves the best performance, consistent with its GTT23 temporal-drift results.Source: C. Cross-Scenario Transfer Evaluation · p. 9
  • 69.9%: SCSM achieves the highest accuracy when transferring from Tor Browser to Chrome, ahead of TMWF at 64.3%.NetCLR, Swallow, and TraVerse score 54.9%, 40.7%, and 27.8%, respectively.Source: C. Cross-Scenario Transfer Evaluation · p. 9

D. Cross-Domain Transfer Evaluation

SCSM transfers across closed-world datasets, open-world recognition, and defended traffic using few-shot adaptation. Its reported results include higher average macro-F1 on closed-world cross-domain tasks and improved recognition and defense-transfer metrics.

1) Closed-World Evaluation:

  • 13.8 percentage points: SCSM pretrained on Swallow D1 exceeds RF in average macro-F1 across four closed-world target datasets, with 81.3% versus 67.5%.The GTT23-pretrained model averages 78.8% macro-F1, 11.3 percentage points above RF.Source: 1) Closed-World Evaluation · p. 9

2) Open-World Evaluation:

  • 71.6%: With Swallow D1 pretraining, SCSM’s maximum recall at 20-precision of at least 80% exceeds its GTT23-pretrained result by 13.6 percentage points.With GTT23 pretraining, maximum recall at that precision requirement is 58.0%, compared with 29.2% for DF and 27.5% for RF.Source: 2) Open-World Evaluation · p. 10

3) Robust Attack Evaluation:

  • 42.5%: SCSM pretrained on Swallow D1 averages macro-F1 across defended-traffic configurations, 16.9% above Swallow, the strongest transferable baseline.The GTT23-pretrained SCSM model averages 40.3%; existing pretrained baselines achieve at most 25.6%.Source: 3) Robust Attack Evaluation · p. 11
  • Under TrafficSliver splitting, Swallow D1-pretrained SCSM scores 81.2%, 59.6%, and 17.0% macro-F1 for RR, BD, and BWR, respectively.These scores exceed RF by 3.2%, 4.0%, and 1.5%, respectively; SCSM’s Segmentation and Masking are described as supporting adaptation to incomplete traces.Source: 3) Robust Attack Evaluation · p. 11
  • Under traffic perturbation, Swallow D1-pretrained SCSM reaches 77.4% macro-F1 under WTF-PAD, exceeding RF by 8.9%, and outperforms other pretrained attacks under FRONT and RegulaTor.All methods obtain low macro-F1 under Tamaraw and Palette; SCSM ranks first in four of the eight configurations.Source: 3) Robust Attack Evaluation · p. 11

4) Multi-Tab Attack Evaluation:

SCSM transfers from single-tab pretraining to multi-tab identification, outperforming supervised and pretrained baselines across the reported settings. The results point to mixed-traffic pretraining as a useful way to learn representations for overlapping page loads.

4) Multi-Tab Attack Evaluation:

  • The evaluation transfers single-tab pretraining to multi-tab identification on ARESSet, reporting P@k and MAP@k with k equal to the number of tabs.Both closed-world and open-world scenarios cover 2–5 tabs.Source: 4) Multi-Tab Attack Evaluation · p. 11
  • SCSM pretrained on GTT23 and Swallow D1 achieves the top two scores for both metrics in every setting, while existing pretrained baselines trail the best supervised attack.The cited comparison notes that overlapping page loads disrupt individual page-load patterns, limiting transfer from isolated traces.Source: 4) Multi-Tab Attack Evaluation · pp. 11–12
  • For closed-world 2-tab identification, Swallow D1-pretrained SCSM reaches 53.47% P@2 and 64.39% MAP@2, gains of 18.26% and 22.16% over the best supervised scores.The gains are absolute, and the cited values correspond to P@2 and MAP@2, respectively.Source: 4) Multi-Tab Attack Evaluation · p. 12
  • In open-world 5-tab identification, SCSM reaches 32.77% MAP@5, 14.48% above the best supervised result of 18.29%.SCSM retains its lead as the number of tabs increases.Source: 4) Multi-Tab Attack Evaluation · p. 12
  • Combination exposes the encoder to mixed traffic during pretraining, while contrastive learning aligns views with the same website composition across different temporal arrangements.The paper links this design to transfer from single-tab source data to multi-tab identification.Source: 4) Multi-Tab Attack Evaluation · p. 12

E. Ablation Study

The ablations find benefits from the full view-construction pipeline and from pretraining, temporal scaling during fine-tuning, and multi-scale inference. Parameter sensitivity is strongest for Masking intensity, while the conclusion frames traffic-grounded self-supervised pretraining as promising across heterogeneous environments with limited target-domain supervision.

E. Ablation Study

  • The ablation reports mean macro centroid classification accuracy and mean 10-shot Accuracy@3 on GTT23 and macro-F1 on Swallow.The reported comparisons span six evaluation weeks and scenarios.Source: E. Ablation Study · p. 12

1) Multi-Level View Construction:

  • The full pipeline beats the unaugmented baseline; Combination and Scaling benefit both datasets, while Segmentation helps Swallow but can weaken GTT23 evidence in short, incomplete traces.Partitioning and reordering those traces may weaken the available website evidence.Source: 1) Multi-Level View Construction · p. 12
  • Masking alone improves over the unaugmented baseline, but removing it at ρ = 0.5 raises accuracy on both datasets; on Swallow, ρ = 0.1 outperforms default and no Masking.The authors suggest excessive Masking may reduce shared website evidence between views.Source: 1) Multi-Level View Construction · p. 12

2) Pretraining and Few-Shot Adaptation:

F. Parameter Sensitivity

  • Combining traces and increasing K from one to two improve representation accuracy, while larger Mmax or K and wider tested overlap bounds offer little further benefit.Masking intensity has a stronger effect: ρ = 0.1 yields the highest observed mean, whereas ρ = 0.9 sharply reduces accuracy.Source: F. Parameter Sensitivity · p. 12
  • Inference accuracy improves with R, but gains diminish beyond five scales; the default R = 5 captures most observed benefit without a larger ensemble.Source: F. Parameter Sensitivity · p. 13

VI. CONCLUSION

  • SCSM combines traffic-native view construction and contrastive pretraining with few-shot fine-tuning and multi-scale inference for transfer across changing conditions.The conclusion describes traffic-grounded self-supervised pretraining as promising across heterogeneous environments with limited target-domain supervision.Source: §VI · p. 13
Loading 2610.07776v1…