Lightweight Graph Mining for Website Fingerprinting Guided by Structure Knowledge

Website fingerprinting (WF) attacks detect malicious websites and safeguard network security by analyzing clients’ browsing traffic. Numerous phishing and pirate websites persist in utilizing Hypertext transfer protocol (HTTP) owing to free transport layer security (TLS) certificates that are readily traceable; thus, they commonly evade deep packet inspection via server cluster, port mapping, and domain generation algorithms. Nowadays, the accurate identification of these websites is dependent on WF attacks developed by deep learning algorithms. Network traffic possesses massive heterogeneous data and high-dimensional complex logical relationships, making it challenging to develop efficient traffic classifiers through generic representation methods. Graphs work well in representing heterogeneous data, but their processing complexity often limits their application in WF. The research proposed a structure-knowledge-guided lightweight graph mining method for WF attacks (SKGM-WF) combining graph generation and association analysis. The heterogeneous graph generation algorithm transformed the input multimodal traffic representation to mine the core structure of graphs using knowledge from HTTP website structures. The association analysis algorithm achieved classification by mining frequent items to construct WFs. A dataset containing over one million website flows is used to evaluate WF attacks. The results indicated that the proposed WF attack consistently categorized websites with over 90% accuracy in several scenarios, which is a fantastic parallel to other state-of-the-art WF attacks. Most notably, its processing time has been reduced by over 31.2%, which is superior for large-scale and automated scenarios.