arXiv:2605.11402cs.LGcs.CR2026-05

通过语义增强与跨层对齐,提升网站指纹识别在真实环境中的泛化能力。

More Than Meets the Eye: A Semantics-Aware Traffic Augmentation Framework for Generalizable Website Fingerprinting

论文配图:More Than Meets the Eye: A Semantics-Aware Traffic Augmentation Framework for Generalizable Website Fingerprinting
图 1 · 摘自论文原文
  • 基于协议规则增强应用层语义,扩展流量模式多样性。
  • 跨层特征对齐使模型在开放场景下准确率提升90.81%。
  • 适合研究网络隐私、流量分析及对抗性机器学习的学者。

基于深度学习的网站指纹技术能有效推断用户访问的网站。尽管现有方法在封闭数据集上表现优异,但在地理和时间变化的真实环境中泛化能力差。根本原因在于应用层资源组合变化与跨层封装导致的可观测特征不稳定性。二者交织引发应用语义与可观测流量特征间的系统性偏移。为此,我们提出SATA框架,先依据协议规则进行应用层语义增强,拓展每条流内资源组合模式与帧序列模式;再通过知识蒸馏引入跨层特征对齐机制,将帧序列与包长序列特征对齐,实现增强语义与可观测序列的跨层匹配。大量实验表明,SATA可生成训练集中不存在但测试集中真实存在的流量模式,显著提升主流模型在复杂场景下的性能。尤其在开放世界设置下,准确率(ACC)提升90.81%,AUROC提升48.37%。原型系统代码已公开于https://anonymous.4open.science/r/SATA-B6C2/。

原文摘要 · Abstract (English)

Deep learning-based website fingerprinting has emerged as an effective technique for inferring the websites users visit. Although existing methods achieve strong performance on closed-world datasets, they often fail to generalize to real-world environments, especially under geographic and temporal shifts. This limitation fundamentally stems from the coupled effects of two key challenges: application-layer resource composition variability and observable feature instability induced by cross-layer encapsulation. Intertwined, these factors induce systematic shifts between underlying application semantics and observable traffic features. To address the above challenges, we propose SATA , a semantics-aware traffic augmentation framework. Specifically, SATA first performs application-layer semantic augmentation based on protocol rules, expanding the resource composition patterns within each flow and frame sequence patterns under protocol constraints. Based on these augmented frame sequences, we further introduce a cross-layer feature alignment mechanism via knowledge distillation. It aligns frame sequence with packet-length sequence features, enabling cross-layer feature alignment between enhanced semantics and observable sequences. Extensive experiments show that SATA successfully generates traffic patterns that are absent from the training set but genuinely exist in the test set, and significantly improves the performance of mainstream models across diverse and complex scenarios. In particular, in open-world settings, SATA improves ACC by 90.81% and AUROC by 48.37%. The source code of the prototype system is available at https://anonymous.4open.science/r/SATA-B6C2/.

网站指纹流量分析泛化能力语义增强

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。