基于TLS握手的多会话网站指纹技术研究
On Multi-Session Website Fingerprinting over TLS Handshake
摘要：
从维护互联网上的服务质量、为用户提供高质量的推荐系统到异常检测和安全连接，分析用户的互联网流量数据和活动在不同方面对用户的体验产生一定的影响。考虑到互联网是一个复杂的网络，我们不能分解每个活动的数据包。因此，我们必须有一个模型，可以识别互联网用户在给定时间内的所有活动。在本文中，我们提出了一种深度学习方法来生成一个多标签分类器，可以预测用户在一定时期内访问的网站。此模型的工作原理是提取TLSv1.2和TLSv1.3客户端Hello数据包中按时间顺序出现的服务器名称。我们将测试数据的结果与出于相同目的开发的简单全连接神经网络进行比较，以证明使用时间序列信息可以提高性能。为了进一步评估，我们在人造数据集和修改后的数据集上测试了模型，以检查模型在不同情况下的准确性。最后，我们提出的模型在测试数据集上达到了95%的准确率，在修改后的数据集和人造数据集上都达到了90%以上。
英文摘要：
Analyzing users' Internet traffic data and activities has a certain impact on users' experiences in different ways, from maintaining the quality of service on the Internet and providing users with high-quality recommendation systems to anomaly detection and secure connection. Considering that the Internet is a complex network, we cannot disintegrate the packets for each activity. Therefore we have to have a model that can identify all the activities an Internet user does in a given period of time. In this paper, we propose a deep learning approach to generate a multi-label classifier that can predict the websites visited by a user in a certain period. This model works by extracting the server names appearing in chronological order in the TLSv1.2 and TLSv1.3 Client Hello packets. We compare the results on the test data with a simple fully-connected neural network developed for the same purpose to prove that using the time-sequential information improves the performance. For further evaluations, we test the model on a human-made dataset and a modified dataset to check the model's accuracy under different circumstances. Finally, our proposed model achieved an accuracy of 95% on the test dataset and above 90% on both the modified dataset and the human-made dataset.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
