Bursttocell-Attn: Remote Fingerprinting Attack for Hs De-Anonymization With Proxied Hidden Service Traffic

Traffic fingerprinting attacks are a viable method for de-anonymizing HSs. However, due to the design of the Tor protocol, the physical location of the service is concealed, making it challenging to obtain traffic from the target HS (HST) for training the fingerprinting model. In this paper, we propose a remote fingerprinting attack method by deploying a Proxy HS and collect its traffic (PHST) to train the fingerprinting model for de-anonymizing HSs. Additionally, we find differences between PHST and HST caused by cell fragmentation and control cells, which leads to limitations of existing cell estimation methods in terms of cross-location traffic, affecting the performance of remote fingerprinting attacks. Based on this, we propose BurstToCell-Attn, by estimating cell sequences from TCP packets and introducing attention blocks, the fingerprinting model is enhanced in learning consistent features across traffic from different locations in Tor. Experimental results show that the performance of remote fingerprinting attack for HS de-anonymization achieves an accuracy of $\mathbf{9 8. 1 \%}$ under BurstToCell-Attn, surpassing models trained with existing cell estimation methods by up to 28 %. Additionally, the proposed cell estimation method can also be applied to local traffic fingerprinting attacks to enhance deanonymization effectiveness.