Website Fingerprinting Attacks And Defenses Research On SSH

With the rapidly development of the Internet, the users put forward higher requirements for the privacy protection on the Internet. Therefore single-hop based SSH anonymous network and multi-hop based Tor anonymous network have been proposed to protect the privacy of users,However, it also caused the problem that network is hardly to be regulated, which led to anonymous abuse. In order to deal with the crime of network efficiently, the website fingerprint attack technology worked on all kinds of anonymous network has been invented. Nonetheless, the attack methods and the previous features cannot play a very good role as to the abnormal data and active defense.Considering the aforementioned problems, we came up with a method for supervising anonymous network, which based on the combination of outgoing traffic and random forest classifier. This method not only can monitor anonymous network with a higher performance, but also get a better classification result compares to other conventional classifiers. The major contributions can be concluded as follow: first of all, the feasibility of choosing outgoing traffic as features has been further proven, the accuracy of the prediction of the random forest classifier can be as high as 80.5%; secondly, besides the original features, the additional five features that we proposed has improved the accuracy of the attacks and reach 89.5% accuracy. Finally, we did the experiment by using eight different defenses methods, to avoid website fingerprinting attack on the incoming and outgoing traffic respectively.According to the results of a series of experiments, the deformation of the traffic, Session Random 255 padding and Packet Random MTU padding has been proven to have better performances, even under the best traffic defenses can keep more than 53.5% accuracy rate, and the incoming traffic and several other classifiers have decreased to a relative low level no more than 30%. The experiment results also show that the performance of classification on outgoing traffic is much better than the incoming traffic. And meanwhile, the random forest classifier has a clear advantage over the other commonly used classifiers on outgoing traffic.