Chameleon: Robust Defense Against Tor Website Fingerprinting via Many-to-Many Traffic Morphing

Website fingerprinting (WF) attacks continue to pose a significant risk to user privacy by inferring browsing activities from encrypted Tor traffic. Current defense mechanisms often create 'learnable web trace mapping features' that are vulnerable to advanced attacks, including defense-aware autoencoder (DAAE)-based methods. A new defense, Chameleon, is proposed, utilizing many-to-many randomized traffic morphing to enhance robustness against these sophisticated WF attacks.

Why it matters

This research addresses a critical vulnerability in privacy-enhancing technologies, specifically the Tor network, which has broad implications for secure communication and data protection. Effective defenses against website fingerprinting are essential for maintaining user anonymity and trust in online services, impacting national security, corporate intelligence, and individual privacy rights.

Key insights

• Website fingerprinting (WF) attacks can infer user browsing activities from encrypted Tor traffic.
• Many existing WF defenses create exploitable 'learnable web trace mapping features'.
• Robustness against adversarial training does not guarantee robustness against defense-aware autoencoder (DAAE)-based attacks.
• Chameleon is a novel WF defense employing many-to-many randomized traffic morphing.
• Chameleon's design involves selecting morphing candidates with high intra-class diversity and low inter-class disparity.
• The defense randomly maps each webpage trace to multiple candidates and allows different webpages to share morphing patterns.

Source

arXiv — Computers and Society — https://arxiv.org/abs/2608.20160