Rethinking Website Fingerprinting: A Critical Study

Anonymous communication networks like The Onion Router (Tor) provide privacy to the end user communications by concealing their identity. As there are adversarial use cases for such networks, website fingerprinting (WF) techniques have been proposed to help uncover the identity of websites and/or the identity of users with traffic analysis techniques. These WF techniques use ML algorithms to identify the website and rely on different statistical features or traffic characteristics extracted. In this paper, we pose several questions related to the utility of such WF models. These questions not only help in gaining confidence in their ability to reliably attribute any communication to a user but also can be used for comparing the performance of such models. We conduct experimental evaluation to answer these questions with a dataset collected and WF models generated using both ML and DL models. Our study reveals that such models suffer from multitude of shortcomings limiting their adoptions to any meaningful use case.