Weiwei Liu

Website fingerprinting attacks that analyze clients' browsing preferences are an important information source for maintaining cybersecurity and improving big data utilization in terms of service quality. Many scholars have studied graph learning because of its powerful learning and inferential capabilities on unstructured network traffic. However, the extensive computing resource requirements of graph neural networks limit their application to large‐scale and automated scenarios. In this paper, we propose a lightweight graph learning method for website fingerprinting attacks called GL‐WF. We designed a four‐level heterogeneous spatiotemporal graph using a multimodal representation of website browsing traffic. We then utilized a graph sampling algorithm to refine the structure of the graph. Finally, a well‐designed graph isomorphism network was used to extract the graph topology for the traffic classifiers. The proposed GL‐WF model, which was evaluated on over 3.6 million website flows, was found to provide high accuracy and efficiency.

Website fingerprinting (WF) attacks analyze encrypted network traffic to exploit side-channel features such as packet sizes, inter-packet timings, and burst patterns, enabling adversaries to infer users’ browsing activities and posing persistent privacy threats even under encryption protocols like TLS. Existing WF defenses primarily rely on static perturbations of coarse statistical features, which fail to reproduce the multi-scale spatio-temporal dynamics of website traffic and are increasingly ineffective against modern deep learning-based classifiers. To address this challenge, we propose WFD-EST, a website fingerprinting defense framework that dynamically emulates spatio-temporal traffic characteristics for fine-grained obfuscation. WFD-EST constructs a multi-scale traffic representation that captures both packet-level dynamics and burst-level correlations. A diffusion-based generator, guided by a fine-tuned large-scale discriminator, synthesizes realistic target traffic templates that preserve structural consistency while reflecting temporal diversity. Based on these templates, a burst-aware manipulation module performs packet padding, insertion, and delay operations to align source flows with target spatio-temporal patterns, generating traffic indistinguishable from real target flows. Evaluations on a real-world dataset comprising 15,000 encrypted samples from three representative websites show that WFD-EST consistently outperforms two state-of-the-art defenses, reducing classification F1 scores by 0.082–0.144 while lowering bandwidth and time overheads by at least 0.086 and 0.054, respectively.

Web services, as the most ubiquitous form of online services, have consistently attracted research attention due to privacy concerns. Although VPNs and anonymous communication methods can partially protect users’ online privacy, advancements in website fingerprinting (WF) attacks still exploit the spatio-temporal characteristics of web resource transmission to identify web services. The challenge lies in defending against WF attacks efficiently, with limited bandwidth costs. Server-side WF defenses, deployed on web servers, can achieve end-to-end obfuscation across both clients and servers. However, existing defenses often consume significant bandwidth and require additional removal operations on the client side. Given the growing use of QUIC with HTTP/3 and the need for robust privacy protections, this paper introduces an asymmetric server-side WF defense scheme using State-Transition Adversarial Perturbations (STAP). STAP introduces the concept of latent resource-state transitions, which represent hidden patterns in resource transmission. Utilizing perturbation models containing these transitions, STAP subtly alters traffic through packet padding and insertion, with inherent transport layer encryption enhancing the concealment. STAP can operate independently, removing the necessity for user involvement. Experimental results demonstrate that STAP outperforms other schemes, achieving reductions in True Positive Rate (TPR) by up to 22% and reductions in bandwidth overhead by up to 30%.

Accurately identifying malicious traffic in heterogeneous IoT environments is critical for network security. Although deep learning-based methods can effectively extract multi-dimensional features and achieve high accuracy, deploying complex models on resource-constrained IoT devices remains challenging. To balance performance and efficiency, we propose IoT-CVKD, a novel malicious IoT traffic identification framework leveraging cross-view knowledge distillation. IoT-CVKD consists of a multi-view teacher model and a lightweight single-view student model. The teacher model characterizes heterogeneous traffic from different perspectives by capturing flow-level global and packet-level spatio-temporal local burst information, and efficiently fuses these features using a cross-attention mechanism. The student model, composed of lightweight and computationally efficient modules, takes only packet-level features as input. Multi-view knowledge from the teacher is then implicitly distilled into the student through cross-view knowledge distillation during training, thereby significantly enhancing the student’s classification capability. Extensive evaluations demonstrate that IoT-CVKD achieves superior classification performance compared to state-of-the-art methods while substantially reducing computational complexity, making it highly suitable for resource-constrained IoT deployments.

Website fingerprinting (WF) attacks detect malicious websites and safeguard network security by analyzing clients’ browsing traffic. Numerous phishing and pirate websites persist in utilizing Hypertext transfer protocol (HTTP) owing to free transport layer security (TLS) certificates that are readily traceable; thus, they commonly evade deep packet inspection via server cluster, port mapping, and domain generation algorithms. Nowadays, the accurate identification of these websites is dependent on WF attacks developed by deep learning algorithms. Network traffic possesses massive heterogeneous data and high-dimensional complex logical relationships, making it challenging to develop efficient traffic classifiers through generic representation methods. Graphs work well in representing heterogeneous data, but their processing complexity often limits their application in WF. The research proposed a structure-knowledge-guided lightweight graph mining method for WF attacks (SKGM-WF) combining graph generation and association analysis. The heterogeneous graph generation algorithm transformed the input multimodal traffic representation to mine the core structure of graphs using knowledge from HTTP website structures. The association analysis algorithm achieved classification by mining frequent items to construct WFs. A dataset containing over one million website flows is used to evaluate WF attacks. The results indicated that the proposed WF attack consistently categorized websites with over 90% accuracy in several scenarios, which is a fantastic parallel to other state-of-the-art WF attacks. Most notably, its processing time has been reduced by over 31.2%, which is superior for large-scale and automated scenarios.

Machine learning-based network traffic classification is crucial for ensuring communication security in Internet of Things (IoT), particularly with unsupervised methods. This approach is valued for its low dependency on manually labeled samples, which is beneficial in scenarios where collecting sufficiently diverse malicious traffic samples is challenging. However, most existing unsupervised methods heavily rely on expert knowledge to extract shallow traffic features for constructing representations, limiting the effective utilization of deep features associated with malicious traffic. Moreover, incomplete traffic data resulting from various efficient but unreliable network transmission protocols in IoT scenarios significantly impact traffic classification performance. In this paper, we propose an unsupervised method for classifying malicious IoT traffic using tensor self-optimization (IoT-TSO). First, packet-wise representations are extracted and constructed into a high-order traffic tensor. Then, tensor singular value decomposition (t-SVD) is employed to achieve tensor self-completion optimization (SCO) and self-expressive optimization (SEO) strategies, transforming the traffic tensor into an optimized form for clustering. SCO leverages the spatio-temporal correlations among packets to recover missing packet representations, while SEO explores the intrinsic relationships between different traffic flows to further enhance classification performance. Typical IoT traffic datasets are used to benchmark the proposed method, with experimental results demonstrating its superior performance over state-of-the-art unsupervised approaches.