Adversarial Traces for Website Fingerprinting Defense

class T i s. We want to pick a target class and re-cast the source sample to be classiied as that target class. To decrease amount of change to the source sample, since adding padding adds bandwidth overhead, we pick the sample from the target pool that is closest to the source sample. We deine closeness using the l 2 norm distance. Formally: D(x, y) = l 2 (xy) I T = argmin

Then we modify the source sample to move toward this target sample.

Our goal is to increase the volumes of selected bursts in the source sample such that the source sample is not classiied as class s and the amount of change is as small as possible to minimize the bandwidth overhead. To make the source sample to leave the source class, we move toward the nearest sample (I T ). We deine ∆ as the perturbation vector that we will add to the source sample to generate its defended form

To ind ∆ that minimizes overhead, we should minimize distance D(I new s , I T ). To do this, we compute the gradient of the distance with respect to the input. The gradient points in the direction of steepest ascent, which would maximize the distance. Therefore, we compute the gradient of the negative of the distance with respect to the input, and we move the source sample that direction towards the target sample. In particular:

, where b i is the i-th burst in input I . To modify the source sample, we change bursts such that their corresponding values in (-D(I , I T )) are positive. Our perturbation vector ∆ is:

where α is paramter that ampliies the output of the gradient. The choice of α has an impact on the convergence and the bandwidth overhead. If we pick large value for α, we will take bigger steps toward the target sample and we will add more overhead. We modify the source sample by summing it with ∆, (I new s = I s + ∆). We iterate this process, computing ∆ for each I s and updating the source sample until we leave the source class, f (I new s ) s or the number of iterations passes the maximum allowed iterations. In our experiments, we set this maximum as 200 iterations.

Because we only increase the bursts where -

> 0, we may run into cases that after some iterations ∇(-D(I, I T )) does not have any positive values or all the positive values are extremely small such that they do not make any signiicant changes to I s . In such cases, if I new s -I s is smaller than a threshold (we used threshold 0.001) for a few iterations (we used 10 iterations), and we are still in the source class, we reill the pool with new samples and pick a new target sample I T to continue the process. In our evaluation, we break the data into two non-overlapping sets: the Attacker Set and the Defender Set. Each set has a monitored set of 83 classes, each representing a website of interest to the attacker, with 360 instances each. Moreover, our dataset contains an unmonitored set of 40,000 instances from 40,000 diferent sites, one instance per site.

We examine the bandwidth overhead and reduction in attacker accuracy of traces protected by our method. We use traces in the training data and generated their defended forms by the method described in the previous section. We irst require a detector (f (x)) to identify when the generated samples leave their source class. Thus, we deine the detector, a CNN model, and train it on the traces in Attacker Set. In our evaluations we examine two cases:

• Case I: We ill the target pool with instances from the Attacker Set. In this case, the detector has been trained on the target classes. • Case II: We ill the target pool with instances from the unmonitored. In this case, the detector has not been trained on the target samples. We generated defended samples with various settings. We varied α and p to evaluate their efect on the strength of the defended traces and the overhead. We measured the detectability of the defended samples by applying the DF attack [8] on them. Sirinam el al. [8] suggest using 5,000 packets. Because both Walkie-Talkie and our method increase the size of the bursts, the number of packets in the traces increases. We thus use an input size of 10,000 packets, which is the 80th percentile of packet sequence lengths in our defended traces.

Figure 2 shows the bandwidth overhead in both Walkie-Talkie (WT) and our method for Case I (solid lines) and II (dashed lines) as α and p vary. As shown in the igure, as we increase α, the bandwidth overhead increases. Larger α values create longer steps toward the target samples and less ine-grained searches for an efective stopping point. Using a larger target pool moderately decreases bandwidth overhead in most cases.

Case I leads to lower bandwidth overhead compared to Case II. Therefore, picking target samples from classes that the detector has been trained on will drop the overhead. In all the evaluated settings, the bandwidth overhead of our method is lower than that of Walkie-Talkie. For α = 1 and p = 5 in Case I, the bandwidth overhead of our defense is 27%, 60% lower than for Walkie-Talkie. On the other end, for α = 15 and p = 5 in Case I, the bandwidth overhead of our defense is 56%, 18% lower than for Walkie-Talkie. Figure 3 depicts the accuracy rate of the DF attack as α and p vary, for input sizes of 5,000 packets and 10,000 packets. Figure 3a and 3b depict the results of the evaluations in Case I and Case II, respectively. As α increases in both cases, the accuracy rate drops to its minimum and then slightly increases. On the other hand, increasing α raises the bandwidth overhead monotonically. Raising target pool size p can moderately increase the attacker's accuracy. According to Figure 3a, the lowest accuracy rate is 59% when α = 10 and p = 1, and its corresponding bandwidth overhead is 53%. α = 10 and p = 1 in Case II provides the lowest accuracy rate (55%) with bandwidth overhead of 63%.

Our evaluations show that Case I provides lower bandwidth overhead than Case II (between 15% to 27% lower) and the detectability of the generated samples is comparable with Case II. This means that picking target samples from classes that the detector trained on reduces bandwidth overhead. According to our results, our best setting is to pick target samples from the classes that the detector trained on with p=1 and α=5. Walkie-Talkie still has lower attack accuracy than this setting, 49% to our 60%, but its bandwidth overhead is 46% higher than our defense.