CipherSight：分布偏移下基于记录-资源语义监督的鲁棒网站指纹识别
CipherSight: Robust Website Fingerprinting via Record-Resource Semantic Supervision under Distribution Shifts
- Harbin Institute of Technology（哈尔滨工业大学）
- Zhongguancun Laboratory（中关村实验室）
- University of Chinese Academy of Sciences（中国科学院大学）
- Beijing University of Posts and Telecommunications（北京邮电大学）
机构由 AI 辅助整理，请以论文原文为准。
中文总结 AI 辅助
该研究针对分布偏移下HTTPS网站指纹识别性能下降问题，提出基于TLS记录的CipherSight框架，通过掩码记录建模与语义蒸馏技术，在2000类网站识别中准确率达95.41%，且分布偏移下仍保持高准确率，优于基线方法。
中文摘要 AI 辅助
HTTPS网站指纹识别（WF）旨在从加密流量中可观测的元数据识别已访问的网站。然而，现实部署中因时间和地理变化会出现显著的分布外（OOD）问题，开放世界场景中也常出现此前未见过的网站。现有方法主要从原始TCP数据包序列中学习，难以捕获稳定且可泛化的网站表示，导致实际条件下性能下降。我们提出CipherSight，这是一个基于TLS记录的分层框架，用于鲁棒HTTPS WF。与依赖TCP数据包序列且对传输层伪影敏感的现有方法不同，CipherSight通过联合编码多个记录级属性，从TLS记录中学习网站表示。它引入分层架构，可捕获TLS记录间的流内依赖关系以及并发流间的流间交互，使模型能利用HTTPS流量中的结构模式。此外，为学习鲁棒表示，CipherSight采用掩码记录建模（MRM）任务捕获上下文流量语义，并通过结构感知目标和语义蒸馏，利用细粒度的记录-资源注释作为特权监督。实验表明，CipherSight在闭世界设置中，针对超过2000个网站类别达到95.41%的准确率，且在时间和地理偏移下均保持90%以上的准确率，始终优于所有评估的基线方法。
英文摘要
HTTPS website fingerprinting (WF) aims to identify visited websites from metadata observable in encrypted traffic. However, real-world deployments introduce a significant out-of-distribution (OOD) problem caused by temporal and geographic changes, while previously unseen websites are common in open-world scenarios. Existing methods primarily learn from raw TCP packet sequences and struggle to capture stable and generalizable website representations, resulting in performance degradation under practical conditions. We propose CipherSight, a TLS-record-based hierarchical framework for robust HTTPS WF. Unlike existing approaches that rely on TCP packet sequences and are sensitive to transport-layer artifacts, CipherSight learns website representations from TLS records by jointly encoding multiple record-level attributes. It introduces a hierarchical architecture that captures both intra-flow dependencies among TLS records and inter-flow interactions across concurrent flows, enabling the model to exploit structural patterns in HTTPS traffic. Besides, to learn robust representations, CipherSight employs a masked record modeling (MRM) task to capture contextual traffic semantics and leverages fine-grained record-resource annotations as privileged supervision through structure-aware objectives and semantic distillation. Experiments show that CipherSight achieves 95.41% accuracy across more than 2,000 website classes in the closed-world setting and maintains over 90% accuracy under both temporal and geographic drift, consistently outperforming all evaluated baselines.
