Deanonymize Tor Hidden Services Using Remote Website Fingerprinting

Website Fingerprinting (WF) is commonly used to deanonymize the Tor users. Meanwhile, WF can also be applied to the hidden service (HS) side, to destroy the anonymity of the HS operator. However, the attacker faces the problem of no available data for training. To solve this problem, previous researchers build mirror sites and use the data collected on them to train the classifier. However, this approach still has limitations: The attacker cannot tell whether the target HS is some HS that is not in the set of sites he mirrors, i.e, an HS in the wild. To address this, we propose a novel two-phase approach to deanonymize HSs that using the website fingerprint collected on the remote node, i.e., a node on the same RP circuit with HS. Our approach does not rely on mirror sites because we decouple feature extraction from classification, so that mirror sites are only involved in the training of the feature extractor and are not related to the classification process. The experimental results show that our attack is effective in both closed-world and open-world scenarios.