One of the most important obligations of privacy-enhancing technologies is to bring confidentiality and privacy to users' browsing activities on the Internet. The website fingerprinting attack enables a local passive eavesdropper to predict the target user's browsing activities even she uses anonymous technologies, such as VPNs, IPsec, and Tor. Recently, the growth of deep learning empowers adversaries to conduct the website fingerprinting attack with higher accuracy. In this paper, we propose a new defense against website fingerprinting attack using adversarial deep learning approaches called Adversarial Website Adaptation (AWA). AWA creates a transformer set in each run so that each website has a unique transformer. Each transformer generates adversarial traces to evade the adversary's classifier. AWA has two versions, including Universal AWA (UAWA) and Non-Universal AWA (NUAWA). Unlike NUAWA, there is no need to access the entire trace of a website in order to generate an adversarial trace in UAWA. We accommodate secret random elements in the training phase of transformers in order for AWA to generate various sets of transformers in each run. We run AWA several times and create multiple sets of transformers. If an adversary and a target user select different sets of transformers, the accuracy of adversary's classifier is almost 19.52% and 31.94% with almost 22.28% and 26.28% bandwidth overhead in UAWA and NUAWA, respectively. If a more powerful adversary generates adversarial traces through multiple sets of transformers and trains a classifier on them, the accuracy of adversary's classifier is almost 49.10% and 25.93% with almost 62.52% and 64.33% bandwidth overhead in UAWA and NUAW, respectively.

中文翻译：

---

AWA：对抗性网站适应


隐私增强技术最重要的义务之一是为用户在互联网上的浏览活动提供机密性和隐私性。网站指纹攻击使本地被动窃听者能够预测目标用户的浏览活动，即使她使用匿名技术，例如 VPN、IPsec 和 Tor。最近，深度学习的发展使对手能够以更高的准确度进行网站指纹攻击。在本文中，我们提出了一种使用对抗性深度学习方法来防御网站指纹攻击的新方法，称为对抗性网站适应（AWA）。 AWA 在每次运行中创建一个变压器集，以便每个网站都有一个唯一的变压器。每个变压器都会生成对抗性痕迹来躲避对手的分类器。 AWA有两个版本，包括通用AWA（UAWA）和非通用AWA（NUAWA）。与 NUAWA 不同的是，在 UAWA 中无需访问网站的整个跟踪即可生成对抗性跟踪。我们在 Transformer 的训练阶段容纳秘密随机元素，以便 AWA 在每次运行中生成各种 Transformer 集合。我们运行 AWA 多次并创建多组变压器。如果对手和目标用户选择不同的变压器组，则对手的分类器的准确率分别接近 19.52% 和 31.94%，UAWA 和 NUAWA 的带宽开销分别接近 22.28% 和 26.28%。如果更强大的对手通过多组 Transformer 生成对抗轨迹并在其上训练分类器，则对手分类器的准确率分别约为 49.10% 和 25.93%，UAWA 和 NUAW 的带宽开销分别约为 62.52% 和 64.33%。