Zoomer: A Website Fingerprinting Attack Against Tor Hidden Services

Abstract

The deanonymization of Tor hidden services (HS) is the top priority for dark web governance. Thanks to the leap of artificial intelligence technology, it is a promising and feasible direction to launch a website fingerprint attack (WFA) by deep learning to identify the access traffic of HS. However, unlike public services (PS) on the surface network, the web pages of HS have simple structures, limited content, and similar development templates. Thus, it is different to extract effective features from the access traffic for HS identification. In addition, many WFA methods cannot capture global features from access traffic because their convolutional neural networks (CNN) lack the ability of long-distance modeling. Aiming at the shortcomings, we propose Zoomer, a novel WFA method with a scalable perspective when extracting features. The contribution of our work lies in three points. Firstly, a burst-based HS fingerprint generation method is proposed to describe the sequence of resource access. Secondly, a new WFA model is designed by introducing global burst attention (GBA) into the classic structure of CNN for global feature extraction. Finally, comparison experiments are conducted in both closed-world and open-world scenarios. The results show that our Zoomer outperforms three state-of-the-art WFA methods.