Re: [Pearg] Website fingerprinting with QUIC

Hello everyone,

I thought you might be interested in our PETS 2021 paper on this topic:
https://petsymposium.org/2021/files/papers/issue2/popets-2021-0017.pdf

The dataset is available at:
https://github.com/jpcsmith/wf-in-the-age-of-quic

Thanks,
Prateek

On Mon, Feb 22, 2021 at 12:14 PM Christian Huitema <huitema@huitema.net>
wrote:

> I will certainly be happy to review papers or otherwise collaborate.
>
>
> -- Christian Huitema
>
>
> On 2/22/2021 7:14 AM, Siby Sandra Deepthy wrote:
>
> Hi Christian,
>
>
> Some of my colleagues and I are currently working on this problem. If
> there are others working/interested in this area, we'd be happy to chat!
>
>
> Regards,
>
> Sandra
> ------------------------------
> *From:* Pearg <pearg-bounces@irtf.org> <pearg-bounces@irtf.org> on behalf
> of Christian Huitema <huitema@huitema.net> <huitema@huitema.net>
> *Sent:* Thursday, February 4, 2021 9:51:59 PM
> *To:* pearg@irtf.org
> *Subject:* [Pearg] Website fingerprinting with QUIC
>
>
> I just saw this paper: Website Fingerprinting on Early QUIC Traffic,
> https://arxiv.org/abs/2101.11871
> <https://urldefense.com/v3/__https:/arxiv.org/abs/2101.11871__;!!Emaut56SYw!kXz4ZIkt-vgb-C_c-7Zccfeyn0EVJivN7iQUAvXg6BorOv_W2qbbDVXLDsB0DoW-tw$>
> .
>
> The authors describe how they trains models to recognize web sites from
> observations of traffic pattern, using features like packet observed in
> both directions of traffic and classification of packets as
> short/medium/full length. They claim that such fingerprinting is easier
> when the transport is using QUIC than when it is using HTTPS. There are
> some limitations in this paper. They test against an early version of
> Google QUIC, not the latest IETF version. They use only the Chrome client,
> thus have to consider just one rendering sequence. They force the clients
> to clear their caches and thus download the full sites, which makes
> identification easier. And they use somewhat charged language, like "the
> insecurity characteristic of QUIC", when they merely demonstrated
> vulnerability to traffic fingerprinting. But then, yes, the results are
> interesting.
>
> When I see papers like that, I am always of two minds. On one hand, I know
> that some features of the QUIC transport like PING or PAD frames make it
> easy to pad packet sizes and to inject traffic that does not interfere with
> the application, and that proper use of such padding and injection might
> disturb the finger printing models used by censors. On the other hand, I am
> aware of the tit-for-tat competition that will ensue, with better
> obfuscation driving development of more efficient finger printing models.
> Still, I wonder whether someone is working on that today: train
> fingerprinting models using techniques similar to those in the paper, and
> then compare how different models of padding and packet injection disturb
> this fingerprinting.
>
> -- Christian Huitema
>
>
>
> --
> Pearg mailing list
> Pearg@irtf.org
> https://www.irtf.org/mailman/listinfo/pearg
>

-- 
Prateek Mittal
Associate Professor
Princeton University
http://www.princeton.edu/~pmittal/