Skip to main content
Disciplines
Automotive Business IT + Informatics Construction + Real Estate Electrical Engineering + Electronics Energy + Sustainability Insurance + Risk Finance + Banking Management + Leadership Marketing + Sales Mechanical Engineering + Materials
Events
DE
EN
Books
Journals
Topic Page
Marketing
Start single access now
Access for companies
EXTENDED SEARCH
Log in
Top
Cluster Computing
Published in: Cluster Computing 4/2018

31-07-2018

An empirical study of web browsers’ resistance to traffic analysis and website fingerprinting attacks

Authors: Taher Al-Shehari, Sami Zhioua

Published in: Cluster Computing | Issue 4/2018

Log in

Activate our intelligent search to find suitable subject content or patents.

search-config
loading …

Abstract

Anonymity protocols are employed to establish encrypted tunnels to protect the privacy of Internet users from traffic analysis attacks. However, the attackers strive to infer some traffic patterns’ characteristics (e.g. packet directions, packet sizes, inter-packet timing, etc.) in order to expose the identities of Internet users and their activities. A recent and popular traffic analysis attack is called website fingerprinting which reveals the identity of websites visited by target users. Existing work in the literature studied the website fingerprinting attack using a single web browser, namely Firefox. In this paper we propose a unified traffic analysis attack model composed of a sequence of phases that demonstrate the efficiency of website fingerprinting attack using popular web browsers under Tor (The Onion Router). In addition, we reveal the main factors that affect the accuracy of website fingerprinting attack over Tor anonymous system and using different browsers. To the best of our knowledge, no previous study uncovered such factors by deploying real-world traffic analysis attack utilizing the top five web browsers. The outcomes of the research are very relevant to Internet users (individuals/companies/governments) since they allow to assess to which extent their privacy is preserved in presence of traffic analysis attacks, in particular, website fingerprinting over different browsers. A recommendation for future research direction regarding the investigation of website fingerprinting over different scenarios is also provided.
previous article A self-scalable distributed network simulation environment based on cloud computing
next article Secure outsourcing algorithms of modular exponentiations with optimal checkability based on a single untrusted cloud server

Dont have a licence yet? Then find out more about our products and how to get one now:

Springer Professional "Wirtschaft+Technik"

Online-Abonnement

Mit Springer Professional "Wirtschaft+Technik" erhalten Sie Zugriff auf:

  • über 102.000 Bücher
  • über 537 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Maschinenbau + Werkstoffe
  • Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

inform now

Springer Professional "Technik"

Online-Abonnement

Mit Springer Professional "Technik" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 390 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Maschinenbau + Werkstoffe




 

Jetzt Wissensvorsprung sichern!

inform now

Springer Professional "Wirtschaft"

Online-Abonnement

Mit Springer Professional "Wirtschaft" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 340 Zeitschriften

aus folgenden Fachgebieten:

  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Versicherung + Risiko




Jetzt Wissensvorsprung sichern!

inform now
Footnotes
Literature
1.
Dingledine, R., Mathewson, N., Syverson, P.: Tor: the second-generation onion router. Naval Research Lab, Washington DC (2004)CrossRef
2.
Berthold, O., Federrath, H., Köpsell, S.: Web MIXes: a system for anonymous and unobservable Internet access. In: Designing privacy enhancing technologies, pp. 115–129. Springer, New York (2001)CrossRef
3.
Warren, S.D., Brandeis, L.D.: The right to privacy. Harvard Law Rev. 4, 193–220 (1890)CrossRef
4.
Clarke, R.: Internet privacy concerns confirm the case for intervention. Commun. ACM 42(2), 60–67 (1999)CrossRef
5.
Culnan, M.J.: “How Did They Get My Name?”: an exploratory investigation of consumer attitudes toward secondary information use. MIS Q. 341–363 (1993)CrossRef
6.
Chung, W., Paynter, J.: Privacy issues on the Internet. In: System Sciences. HICSS. Proceedings of the 35th Annual Hawaii International Conference on 2002, p. 9 pp. IEEE (2002)
7.
Hintz, A.: Fingerprinting websites using traffic analysis. In: International Workshop on Privacy Enhancing Technologies, pp. 171–178. Springer (2002)
8.
9.
Bissias, G.D., Liberatore, M., Jensen, D., Levine, B.N.: Privacy vulnerabilities in encrypted HTTP streams. In: International Workshop on Privacy Enhancing Technologies, pp. 1–11. Springer (2005)
10.
Panchenko, A., Niessen, L., Zinnen, A., Engel, T.: Website fingerprinting in onion routing based anonymization networks. In: Proceedings of the 10th annual ACM workshop on Privacy in the electronic society, pp. 103–114. ACM (2011)
11.
Al-Shehari, T., Shahzad, F.: Improving Operating system fingerprinting using machine learning techniques. Int. J. Comput. Theor. Eng. 6(1), 57 (2014)CrossRef
12.
Herrmann, D., Wendolsky, R., Federrath, H.: Website fingerprinting: attacking popular privacy enhancing technologies with the multinomial naïve-bayes classifier. In: Proceedings of the 2009 ACM workshop on Cloud computing security, pp. 31–42. ACM (2009)
13.
Cai, X., Zhang, X.C., Joshi, B., Johnson, R.: Touching from a distance: Website fingerprinting attacks and defenses. In: Proceedings of the 2012 ACM conference on Computer and communications security, pp. 605–616. ACM (2012)
14.
Craven, R.M.: Traffic analysis of anonymity systems. Clemson University, Clemson (2010)
15.
16.
Pfitzmann, A., Köhntopp, M.: Anonymity, unobservability, and pseudonymity—a proposal for terminology. In: Designing privacy enhancing technologies, pp. 1–9. Springer, New York (2001)
17.
Chaum, D.L.: Untraceable electronic mail, return addresses, and digital pseudonyms. Commun. ACM 24(2), 84–90 (1981)CrossRef
18.
Möller, U., Cottrell, L., Palfrader, P., Sassaman, L.: Mixmaster protocol—version 2. Draft, July 154, 28 (2003)
19.
Mathewson, N., Dingledine, R.: Practical traffic analysis: Extending and resisting statistical disclosure. In: Privacy Enhancing Technologies, pp. 17–34. Springer, New York (2004)CrossRef
20.
Berthold, O., Hannes, F., Stefan, K.: Web MIXes: A system for anonymous and unobservable Internet access. In: Designing privacy enhancing technologies. Springer, Berlin, Heidelberg (2001)CrossRef
21.
Zantout, B., Haraty, R.: I2P data communication system. In: Proceedings of ICN, pp. 401–409 (2011)
22.
Bielova, N.: Survey on JavaScript security policies and their enforcement mechanisms in a web browser. J. Logic Algebr. Progr. 82(8), 243–262 (2013)CrossRef
23.
Garsiel, T., Irish, P.: How browsers work: Behind the scenes of modern web browsers. Google Project, August (2011)
24.
Liberatore, M., Levine, B.N.: Inferring the source of encrypted HTTP connections. In: Proceedings of the 13th ACM conference on Computer and communications security, pp. 255–263. ACM (2006)
25.
Shi, Y., Matsuura, K.: Fingerprinting Attack on the Tor Anonymity System. In: ICICS, pp. 425–438. Springer, New York (2009)CrossRef
26.
Wang, T., Goldberg, I.: Improved website fingerprinting on tor. In: Proceedings of the 12th ACM workshop on Workshop on privacy in the electronic society, pp. 201–212. ACM (2013)
27.
Zhioua, S.: The web browser factor in traffic analysis attacks. Secur. Commun. Netw. 8(18), 4227–4241 (2015)CrossRef
28.
Fuchs, C., Boersma, K., Albrechtslund, A., Sandoval, M.: Internet and surveillance: The challenges of Web 2.0 and social media, vol. 16. Routledge, (2013)
29.
Abu-Amara, M.: A combined solution for the Internet access denial caused by malicious Internet service providers. Secur. Commun. Netw. 7(11), 2078–2093 (2014)CrossRef
30.
Lyon, D.: Surveillance after September 11, vol. 11. Polity, (2003)
31.
Zhang, Y., Su, S., Wang, Y., Chen, W., Yang, F.: Privacy-assured substructure similarity query over encrypted graph-structured data in cloud. Secur. Commun. Netw. 7(11), 1933–1944 (2014)CrossRef
32.
Johnson, A., Wacek, C., Jansen, R., Sherr, M., Syverson, P.: Users get routed: Traffic correlation on Tor by realistic adversaries. In: Proceedings of the 2013 ACM SIGSAC Conference on Computer & communications security, pp. 337–348. ACM (2013)
33.
Navarro, G.: A guided tour to approximate string matching. ACM Comput. Surv. (CSUR) 33(1), 31–88 (2001)CrossRef
34.
Gehrig, A.P.: Detection of spoofing of remote client system information. In. Google Patents, (2015)
35.
36.
37.
38.
Ihrig, C.: Profiling Page Loads with the Navigation Timing API. (1 September 2012). (2017)
39.
Crowley, M.: Pro Internet Explorer 8 & 9 Development: Developing Powerful Applications for the Next Generation of IE. Apress, New York (2011)
40.
Wang, W., Motani, M., Srinivasan, V.: Dependent link padding algorithms for low latency anonymity systems. In: Proceedings of the 15th ACM conference on Computer and communications security, pp. 323–332. ACM (2008)
41.
Butkiewicz, M., Madhyastha, H.V., Sekar, V.: Understanding website complexity: measurements, metrics, and implications. In: Proceedings of the 2011 ACM SIGCOMM conference on Internet measurement conference, pp. 313–328. ACM (2011)
42.
Akhawe, D., Felt, A.P.: Alice in Warningland: A Large-Scale Field Study of Browser Security Warning Effectiveness. In: USENIX security symposium (2013)
43.
Barker, T.: What is Performance. In: Pro JavaScript Performance. pp. 1–12. Springer, New York (2012)CrossRef
44.
Guha, A., Fredrikson, M., Livshits, B., Swamy, N.: Verified security for browser extensions. In: Security and Privacy (SP), IEEE Symposium on 2011, pp. 115–130. IEEE (2011)
45.
Holland, M.C.: Assessment of content delivery services using performance measurements from within an end user client application. In. Google Patents, (2017)
46.
47.
48.
49.
Okazaki, N., Toyoda, K., Yokoyama, E., So, H., Katayama, T., Park, M.: Countermeasure against fingerprinting attack in Tor by separated contents retrieval. IEICE Commun. Express 4(12), 370–375 (2015)CrossRef
50.
Yang, Q., Gasti, P., Zhou, G., Farajidavar, A., Balagani, K.S.: On inferring browsing activity on smartphones via USB power analysis side-channel. IEEE Trans. Inf. Forensics Secur. 12(5), 1056–1066 (2017)CrossRef
51.
Gu, X., Yang, M., Luo, J.: A novel website fingerprinting attack against multi-tab browsing behavior. In: Computer Supported Cooperative Work in Design (CSCWD), IEEE 19th International Conference on 2015, pp. 234–239. IEEE (2015)
Metadata
Title
An empirical study of web browsers’ resistance to traffic analysis and website fingerprinting attacks
Authors
Taher Al-Shehari
Sami Zhioua
Publication date
31-07-2018
Publisher
Springer US
Published in
Cluster Computing / Issue 4/2018
Print ISSN: 1386-7857
Electronic ISSN: 1573-7543
DOI
https://doi.org/10.1007/s10586-018-2817-4

Other articles of this Issue 4/2018

Cluster Computing 4/2018 Go to the issue

OriginalPaper

Optimizing of metadata management in large-scale file systems

OriginalPaper

DEFAD: ensemble classifier for DDOS enabled flood attack defense in distributed network environment

OriginalPaper

Evaluation of site availability exploitation towards performance optimization in data grids

OriginalPaper

Secure outsourcing algorithms of modular exponentiations with optimal checkability based on a single untrusted cloud server

OriginalPaper

Towards operational cost minimization for cloud bursting with deadline constraints in hybrid clouds

OriginalPaper

A self-scalable distributed network simulation environment based on cloud computing

Premium Partner

    Image Credits