{"id":155002,"date":"2024-04-23T16:12:33","date_gmt":"2024-04-23T20:12:33","guid":{"rendered":"https:\/\/www.hajim.rochester.edu\/senior-design-day\/?p=155002"},"modified":"2025-05-02T14:53:16","modified_gmt":"2025-05-02T18:53:16","slug":"fingerprinting-vpn-traffic-an-evaluation-of-website-fingerprinting-attacks-on-modern-virtual-private-network-applications","status":"publish","type":"post","link":"https:\/\/www.hajim.rochester.edu\/senior-design-day\/fingerprinting-vpn-traffic-an-evaluation-of-website-fingerprinting-attacks-on-modern-virtual-private-network-applications\/","title":{"rendered":"Fingerprinting VPN Traffic: An Evaluation of Website Fingerprinting Attacks on Modern Virtual Private Network Applications"},"content":{"rendered":"\r\n<h2 class=\"wp-block-heading\">Author<\/h2>\r\n\r\n\r\n\r\n<p>Steven Oufan Hai<\/p>\r\n\r\n\r\n\r\n<h2 class=\"wp-block-heading\">Mentors<\/h2>\r\n\r\n\r\n\r\n<p>Adam Purtee and John Criswell<\/p>\r\n\r\n\r\n\r\n<h2 class=\"wp-block-heading\">Abstract<\/h2>\r\n<p>VPNs are increasingly promoted as a privacy-enhancing technology and a solution to protecting users\u2019 privacy from surveillance and cyber attacks. While most VPN protocols encrypt users\u2019 browsing traffic, the research community has repeatedly demonstrated that encryption algorithms need not be broken for malicious agents with knowledge of users\u2019 encrypted traffic to fingerprint the websites they visit. We investigate whether advancements in VPN technologies in the last two decades make VPNs harder to fingerprint. We collected 643 GB of raw Internet Traffic containing about 400,000 traces. We train and evaluate supervised machine learning models on the VPN traffic collected through open-world website fingerprinting. Our simple but effective machine learning classifiers achieved performance (F1 \u2248 0.95) comparable to those classifiers using deep neural networks for commercial VPNs. We show that VPN traffic is at least as easy to fingerprint as bare HTTPS traffic. We also found generalizability in models trained on certain VPN datasets. Our findings suggest that modern commercial VPNs urgently need to implement features that deter website fingerprinting.<\/p>\r\n<h2>Background<\/h2>\r\n<p>VPNs are increasingly promoted as a privacy-enhancing technology and a solution to protecting users&#8217; privacy from surveillance and cyber attacks. While most VPN protocols encrypt users\u2019 browsing traffic, the research community has repeatedly demonstrated that encryption algorithms need not be broken for malicious agents with knowledge of users&#8217; encrypted traffic to fingerprint the websites they visit. We investigate whether newer VPN technologies (protocols and privacy-enhancing features) make VPN traffic harder to fingerprint.<\/p>\r\n<h2>Contributions\u00a0<\/h2>\r\n<ul>\r\n<li>New datasets containing <strong>643 GB<\/strong> of VPN traffic.<\/li>\r\n<li>We show that when performing website fingerprinting on VPN traffic, simple but effective machine learning classifiers achieved performance (<em>F1<\/em> \u2248 0.95) comparable to classifiers using <strong>deep neural networks<\/strong>.<\/li>\r\n<li>We show that VPN traffic is often as easy to fingerprint as <strong>bare HTTPS traffic<\/strong>.<\/li>\r\n<li>Website Fingerprinting classifiers trained on one dataset <strong>remain effective<\/strong> when evaluated on different datasets.<\/li>\r\n<\/ul>\r\n<h2>Threat Model\u00a0<\/h2>\r\n<p>We assume the attacker has direct access to users&#8217; Internet traffic. Some entities with such capabilities are the state (especially authoritarian ones), Internet Service Providers (ISPs), and compromised machines on the same network.<\/p>\r\n<p>We assume the attacker is able to purchase all the commercial VPNs available on the market. The attacker collects their own datasets to train custom machine learning models. Similar to Sirinam et al.&#8217;s threat model, we further assume that the attacker has a list of &#8220;monitored&#8221; websites. The goal of website fingerprinting attacks is to determine if the user visits a website in the monitored set [2].\u00a0<\/p>\r\n<h2>Data Set Creation<\/h2>\r\n<div style=\"display: flex; justify-content: space-between;\">\r\n<div style=\"width: 48%; padding: 10px;\">\r\n<ol>\r\n<li><strong>Packet Capturing<\/strong>: Capturing `.pcap&#8217; files using Selenium and tcpdump.<\/li>\r\n<li><strong>Feature Extraction<\/strong>: We extract three types of features [1,3] from the network traffic captured.<\/li>\r\n<\/ol>\r\n<\/div>\r\n<div style=\"width: 48%; padding: 10px;\"><!-- <img decoding=\"async\" src=\"feature-eng-eg.png\" alt=\"Feature Engineering Example\" style=\"width: 100%; height: auto;\"> -->\r\n<ul>\r\n<li>Length + Direction (e.g. [4, -54, 60, -60, 54])<\/li>\r\n<li>Direction (e.g. [1, -1, 1, -1, 1])<\/li>\r\n<li>Unique Packet Sizes (e.g. [4, 54, 60])<\/li>\r\n<\/ul>\r\n<\/div>\r\n<\/div>\r\n<h2>Experiments\u00a0<\/h2>\r\n<h3>Performance of Models\u00a0<\/h3>\r\n<p>Deep CNN-based website fingerprinting models (e.g., Deep Fingerprinting with 8 Convolutional Layers [2]) do not perform significantly better than simple models (e.g., single-layered CNN) when the number of monitored websites is less than 100.<\/p>\r\n<h3><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-178732 size-full\" src=\"https:\/\/www.hajim.rochester.edu\/senior-design-day\/wp-content\/uploads\/2024\/04\/increasing-website-mullvad-WG-dir.png\" alt=\"\" width=\"948\" height=\"547\" srcset=\"https:\/\/www.hajim.rochester.edu\/senior-design-day\/wp-content\/uploads\/2024\/04\/increasing-website-mullvad-WG-dir.png 948w, https:\/\/www.hajim.rochester.edu\/senior-design-day\/wp-content\/uploads\/2024\/04\/increasing-website-mullvad-WG-dir-300x173.png 300w, https:\/\/www.hajim.rochester.edu\/senior-design-day\/wp-content\/uploads\/2024\/04\/increasing-website-mullvad-WG-dir-768x443.png 768w\" sizes=\"auto, (max-width: 948px) 100vw, 948px\" \/>Performance of Features<\/h3>\r\n<p>VPN traffic is at least as easy to fingerprint as bare HTTPS traffic when the right feature is used. 1-dimensional metadata (packet direction sequence) makes VPN traffic more fingerprintable than HTTPS.<\/p>\r\n<table style=\"height: 370px;\" width=\"895\">\r\n<tbody>\r\n<tr>\r\n<th>\u00a0<\/th>\r\n<th>Length + Direction<\/th>\r\n<th>Direction<\/th>\r\n<th>Unique Sizes<\/th>\r\n<\/tr>\r\n<tr>\r\n<td>HTTPS<\/td>\r\n<td><strong>0.8995<\/strong><\/td>\r\n<td>0.7211<\/td>\r\n<td><strong>0.7470<\/strong><\/td>\r\n<\/tr>\r\n<tr>\r\n<td>OpenVPN<\/td>\r\n<td>0.8854<\/td>\r\n<td>0.9156<\/td>\r\n<td>0.7439<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>WireGuard<\/td>\r\n<td>0.8954<\/td>\r\n<td><strong>0.9500<\/strong><\/td>\r\n<td>0.7437<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>Average<\/td>\r\n<td>0.8935<\/td>\r\n<td>0.8622<\/td>\r\n<td>0.7448<\/td>\r\n<\/tr>\r\n<\/tbody>\r\n<\/table>\r\n<h2>Cross-VPN Fingerprinting\u00a0<\/h2>\r\n<p>We found that classifiers trained on one dataset remain effective when evaluated on different datasets. For example, machine learning models trained on ExpressVPN traffic accurately classify the NordVPN traffic.<\/p>\r\n<h2><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-178822\" src=\"https:\/\/www.hajim.rochester.edu\/senior-design-day\/wp-content\/uploads\/2024\/04\/crossvpn-diagnal.png\" alt=\"\" width=\"819\" height=\"682\" srcset=\"https:\/\/www.hajim.rochester.edu\/senior-design-day\/wp-content\/uploads\/2024\/04\/crossvpn-diagnal.png 819w, https:\/\/www.hajim.rochester.edu\/senior-design-day\/wp-content\/uploads\/2024\/04\/crossvpn-diagnal-300x250.png 300w, https:\/\/www.hajim.rochester.edu\/senior-design-day\/wp-content\/uploads\/2024\/04\/crossvpn-diagnal-768x640.png 768w\" sizes=\"auto, (max-width: 819px) 100vw, 819px\" \/>Conclusion\u00a0<\/h2>\r\n<p>Our results challenge commercial VPN providers&#8217; claim that their services could serve as an effective deterrence against surveillance and cyber attacks. With limited data (our largest training set contains 20,000 traces), we trained classifiers that are highly effective at fingerprinting websites. We conclude that website fingerprinting continues to be a challenge to privacy.<\/p>\r\n<h2>Acknowledgments\u00a0<\/h2>\r\n<p>I give my most sincere thanks to my advisors, Professor Adam Purtee and Professor John Criswell, for their invaluable guidance over the past year. I also thank Prof. Andrew Read-McFarland for his advice.\u00a0<\/p>\r\n<p><br \/>I am very grateful to the River Campus Library at the University of Rochester for supporting this research project with the Data Set Grant for two consecutive terms. I thank the great librarians I have worked with: Kathy Wu, Arjay Romanowski, and Heather Owen.<\/p>\r\n<h2>Reference\u00a0<\/h2>\r\n<div class=\"textLayer\"><span dir=\"ltr\" role=\"presentation\">[1] Dominik Herrmann, Rolf Wendolsky, and Hannes Federrath. Website fingerprinting: Attacking popular privacy enhancing technologies <\/span><span dir=\"ltr\" role=\"presentation\">with the multinomial na\u00efve-bayes classifier. In<\/span> <span dir=\"ltr\" role=\"presentation\">Proceedings of the 2009 ACM Workshop on Cloud Computing Security<\/span><span dir=\"ltr\" role=\"presentation\">, CCSW \u201909, New York, <\/span><span dir=\"ltr\" role=\"presentation\">NY, USA, 2009. Association for Computing Machinery.<\/span><br role=\"presentation\" \/><span dir=\"ltr\" role=\"presentation\">[2]<\/span> <span dir=\"ltr\" role=\"presentation\">Payap Sirinam, Mohsen Imani, Marc Juarez, and Matthew Wright. Deep fingerprinting: Undermining website fingerprinting defenses with <\/span><span dir=\"ltr\" role=\"presentation\">deep learning. In<\/span> <span dir=\"ltr\" role=\"presentation\">Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security<\/span><span dir=\"ltr\" role=\"presentation\">, 2018.<\/span><br role=\"presentation\" \/><span dir=\"ltr\" role=\"presentation\">[3]<\/span> <span dir=\"ltr\" role=\"presentation\">Junhua Yan and Jasleen Kaur. Feature selection for website fingerprinting.<\/span> <span dir=\"ltr\" role=\"presentation\">Proceedings on Privacy Enhancing Technologies<\/span><span dir=\"ltr\" role=\"presentation\">, 2018.<\/span><\/div>\r\n<div class=\"annotationLayer\">\u00a0<\/div>\r\n<p><a href=\"https:\/\/www.hajim.rochester.edu\/senior-design-day\/wp-content\/uploads\/2024\/04\/Steven-Hai-POSTER-1.pdf\">Fingerprinting VPN Traffic<\/a><\/p>\r\n","protected":false},"excerpt":{"rendered":"<p>VPNs are increasingly promoted as a privacy-enhancing technology and a solution to protecting users\u2019 privacy from surveillance and cyber attacks.1 While most VPN protocols encrypt users\u2019 browsing traffic, the research community has repeatedly demonstrated that encryption algorithms need not be broken for malicious agents with knowledge of users\u2019 encrypted traffic to fingerprint the websites they visit. We investigate whether advancements in VPN technologies in the last two decades make VPNs harder to fingerprint. <\/p>\n","protected":false},"author":6242,"featured_media":179012,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_coblocks_attr":"","_coblocks_dimensions":"","_coblocks_responsive_height":"","_coblocks_accordion_ie_support":"","_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[4442,96],"tags":[],"coauthors":[8612],"class_list":["post-155002","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-archive","category-csc-archive"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.5 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Fingerprinting VPN Traffic: An Evaluation of Website Fingerprinting Attacks on Modern Virtual Private Network Applications - Senior Design Day<\/title>\n<meta name=\"description\" content=\"VPNs are increasingly promoted as a privacy-enhancing technology and a solution to protecting users\u2019 privacy from surveillance and cyber attacks. While most VPN protocols encrypt users\u2019 browsing traffic, the research community has repeatedly demonstrated that encryption algorithms need not be broken for malicious agents with knowledge of users\u2019 encrypted traffic to fingerprint the websites they visit. We investigate whether advancements in VPN technologies in the last two decades make VPNs harder to fingerprint.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.hajim.rochester.edu\/senior-design-day\/fingerprinting-vpn-traffic-an-evaluation-of-website-fingerprinting-attacks-on-modern-virtual-private-network-applications\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Fingerprinting VPN Traffic: An Evaluation of Website Fingerprinting Attacks on Modern Virtual Private Network Applications - Senior Design Day\" \/>\n<meta property=\"og:description\" content=\"VPNs are increasingly promoted as a privacy-enhancing technology and a solution to protecting users\u2019 privacy from surveillance and cyber attacks. While most VPN protocols encrypt users\u2019 browsing traffic, the research community has repeatedly demonstrated that encryption algorithms need not be broken for malicious agents with knowledge of users\u2019 encrypted traffic to fingerprint the websites they visit. We investigate whether advancements in VPN technologies in the last two decades make VPNs harder to fingerprint.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.hajim.rochester.edu\/senior-design-day\/fingerprinting-vpn-traffic-an-evaluation-of-website-fingerprinting-attacks-on-modern-virtual-private-network-applications\/\" \/>\n<meta property=\"og:site_name\" content=\"Senior Design Day\" \/>\n<meta property=\"article:published_time\" content=\"2024-04-23T20:12:33+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-05-02T18:53:16+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.hajim.rochester.edu\/senior-design-day\/wp-content\/uploads\/2024\/04\/poster-cover-1200x630.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.hajim.rochester.edu\\\/senior-design-day\\\/fingerprinting-vpn-traffic-an-evaluation-of-website-fingerprinting-attacks-on-modern-virtual-private-network-applications\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.hajim.rochester.edu\\\/senior-design-day\\\/fingerprinting-vpn-traffic-an-evaluation-of-website-fingerprinting-attacks-on-modern-virtual-private-network-applications\\\/\"},\"author\":{\"name\":\"admin\",\"@id\":\"https:\\\/\\\/www.hajim.rochester.edu\\\/senior-design-day\\\/#\\\/schema\\\/person\\\/351018fbcf84ed8cac6d8072ba5b347c\"},\"headline\":\"Fingerprinting VPN Traffic: An Evaluation of Website Fingerprinting Attacks on Modern Virtual Private Network Applications\",\"datePublished\":\"2024-04-23T20:12:33+00:00\",\"dateModified\":\"2025-05-02T18:53:16+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.hajim.rochester.edu\\\/senior-design-day\\\/fingerprinting-vpn-traffic-an-evaluation-of-website-fingerprinting-attacks-on-modern-virtual-private-network-applications\\\/\"},\"wordCount\":799,\"image\":{\"@id\":\"https:\\\/\\\/www.hajim.rochester.edu\\\/senior-design-day\\\/fingerprinting-vpn-traffic-an-evaluation-of-website-fingerprinting-attacks-on-modern-virtual-private-network-applications\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.hajim.rochester.edu\\\/senior-design-day\\\/wp-content\\\/uploads\\\/2024\\\/04\\\/poster-cover.png\",\"articleSection\":[\"3. Programs Archive\",\"CSC Archive\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.hajim.rochester.edu\\\/senior-design-day\\\/fingerprinting-vpn-traffic-an-evaluation-of-website-fingerprinting-attacks-on-modern-virtual-private-network-applications\\\/\",\"url\":\"https:\\\/\\\/www.hajim.rochester.edu\\\/senior-design-day\\\/fingerprinting-vpn-traffic-an-evaluation-of-website-fingerprinting-attacks-on-modern-virtual-private-network-applications\\\/\",\"name\":\"Fingerprinting VPN Traffic: An Evaluation of Website Fingerprinting Attacks on Modern Virtual Private Network Applications - Senior Design Day\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.hajim.rochester.edu\\\/senior-design-day\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.hajim.rochester.edu\\\/senior-design-day\\\/fingerprinting-vpn-traffic-an-evaluation-of-website-fingerprinting-attacks-on-modern-virtual-private-network-applications\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.hajim.rochester.edu\\\/senior-design-day\\\/fingerprinting-vpn-traffic-an-evaluation-of-website-fingerprinting-attacks-on-modern-virtual-private-network-applications\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.hajim.rochester.edu\\\/senior-design-day\\\/wp-content\\\/uploads\\\/2024\\\/04\\\/poster-cover.png\",\"datePublished\":\"2024-04-23T20:12:33+00:00\",\"dateModified\":\"2025-05-02T18:53:16+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.hajim.rochester.edu\\\/senior-design-day\\\/#\\\/schema\\\/person\\\/351018fbcf84ed8cac6d8072ba5b347c\"},\"description\":\"VPNs are increasingly promoted as a privacy-enhancing technology and a solution to protecting users\u2019 privacy from surveillance and cyber attacks. While most VPN protocols encrypt users\u2019 browsing traffic, the research community has repeatedly demonstrated that encryption algorithms need not be broken for malicious agents with knowledge of users\u2019 encrypted traffic to fingerprint the websites they visit. We investigate whether advancements in VPN technologies in the last two decades make VPNs harder to fingerprint.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.hajim.rochester.edu\\\/senior-design-day\\\/fingerprinting-vpn-traffic-an-evaluation-of-website-fingerprinting-attacks-on-modern-virtual-private-network-applications\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.hajim.rochester.edu\\\/senior-design-day\\\/fingerprinting-vpn-traffic-an-evaluation-of-website-fingerprinting-attacks-on-modern-virtual-private-network-applications\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.hajim.rochester.edu\\\/senior-design-day\\\/fingerprinting-vpn-traffic-an-evaluation-of-website-fingerprinting-attacks-on-modern-virtual-private-network-applications\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.hajim.rochester.edu\\\/senior-design-day\\\/wp-content\\\/uploads\\\/2024\\\/04\\\/poster-cover.png\",\"contentUrl\":\"https:\\\/\\\/www.hajim.rochester.edu\\\/senior-design-day\\\/wp-content\\\/uploads\\\/2024\\\/04\\\/poster-cover.png\",\"width\":2960,\"height\":1784},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.hajim.rochester.edu\\\/senior-design-day\\\/fingerprinting-vpn-traffic-an-evaluation-of-website-fingerprinting-attacks-on-modern-virtual-private-network-applications\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.hajim.rochester.edu\\\/senior-design-day\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Fingerprinting VPN Traffic: An Evaluation of Website Fingerprinting Attacks on Modern Virtual Private Network Applications\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.hajim.rochester.edu\\\/senior-design-day\\\/#website\",\"url\":\"https:\\\/\\\/www.hajim.rochester.edu\\\/senior-design-day\\\/\",\"name\":\"Senior Design Day\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.hajim.rochester.edu\\\/senior-design-day\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.hajim.rochester.edu\\\/senior-design-day\\\/#\\\/schema\\\/person\\\/351018fbcf84ed8cac6d8072ba5b347c\",\"name\":\"admin\",\"url\":\"https:\\\/\\\/www.hajim.rochester.edu\\\/senior-design-day\\\/author\\\/seniordesign\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Fingerprinting VPN Traffic: An Evaluation of Website Fingerprinting Attacks on Modern Virtual Private Network Applications - Senior Design Day","description":"VPNs are increasingly promoted as a privacy-enhancing technology and a solution to protecting users\u2019 privacy from surveillance and cyber attacks. While most VPN protocols encrypt users\u2019 browsing traffic, the research community has repeatedly demonstrated that encryption algorithms need not be broken for malicious agents with knowledge of users\u2019 encrypted traffic to fingerprint the websites they visit. We investigate whether advancements in VPN technologies in the last two decades make VPNs harder to fingerprint.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.hajim.rochester.edu\/senior-design-day\/fingerprinting-vpn-traffic-an-evaluation-of-website-fingerprinting-attacks-on-modern-virtual-private-network-applications\/","og_locale":"en_US","og_type":"article","og_title":"Fingerprinting VPN Traffic: An Evaluation of Website Fingerprinting Attacks on Modern Virtual Private Network Applications - Senior Design Day","og_description":"VPNs are increasingly promoted as a privacy-enhancing technology and a solution to protecting users\u2019 privacy from surveillance and cyber attacks. While most VPN protocols encrypt users\u2019 browsing traffic, the research community has repeatedly demonstrated that encryption algorithms need not be broken for malicious agents with knowledge of users\u2019 encrypted traffic to fingerprint the websites they visit. We investigate whether advancements in VPN technologies in the last two decades make VPNs harder to fingerprint.","og_url":"https:\/\/www.hajim.rochester.edu\/senior-design-day\/fingerprinting-vpn-traffic-an-evaluation-of-website-fingerprinting-attacks-on-modern-virtual-private-network-applications\/","og_site_name":"Senior Design Day","article_published_time":"2024-04-23T20:12:33+00:00","article_modified_time":"2025-05-02T18:53:16+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/www.hajim.rochester.edu\/senior-design-day\/wp-content\/uploads\/2024\/04\/poster-cover-1200x630.png","type":"image\/png"}],"author":"admin","twitter_card":"summary_large_image","twitter_misc":{"Written by":"admin","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.hajim.rochester.edu\/senior-design-day\/fingerprinting-vpn-traffic-an-evaluation-of-website-fingerprinting-attacks-on-modern-virtual-private-network-applications\/#article","isPartOf":{"@id":"https:\/\/www.hajim.rochester.edu\/senior-design-day\/fingerprinting-vpn-traffic-an-evaluation-of-website-fingerprinting-attacks-on-modern-virtual-private-network-applications\/"},"author":{"name":"admin","@id":"https:\/\/www.hajim.rochester.edu\/senior-design-day\/#\/schema\/person\/351018fbcf84ed8cac6d8072ba5b347c"},"headline":"Fingerprinting VPN Traffic: An Evaluation of Website Fingerprinting Attacks on Modern Virtual Private Network Applications","datePublished":"2024-04-23T20:12:33+00:00","dateModified":"2025-05-02T18:53:16+00:00","mainEntityOfPage":{"@id":"https:\/\/www.hajim.rochester.edu\/senior-design-day\/fingerprinting-vpn-traffic-an-evaluation-of-website-fingerprinting-attacks-on-modern-virtual-private-network-applications\/"},"wordCount":799,"image":{"@id":"https:\/\/www.hajim.rochester.edu\/senior-design-day\/fingerprinting-vpn-traffic-an-evaluation-of-website-fingerprinting-attacks-on-modern-virtual-private-network-applications\/#primaryimage"},"thumbnailUrl":"https:\/\/www.hajim.rochester.edu\/senior-design-day\/wp-content\/uploads\/2024\/04\/poster-cover.png","articleSection":["3. Programs Archive","CSC Archive"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.hajim.rochester.edu\/senior-design-day\/fingerprinting-vpn-traffic-an-evaluation-of-website-fingerprinting-attacks-on-modern-virtual-private-network-applications\/","url":"https:\/\/www.hajim.rochester.edu\/senior-design-day\/fingerprinting-vpn-traffic-an-evaluation-of-website-fingerprinting-attacks-on-modern-virtual-private-network-applications\/","name":"Fingerprinting VPN Traffic: An Evaluation of Website Fingerprinting Attacks on Modern Virtual Private Network Applications - Senior Design Day","isPartOf":{"@id":"https:\/\/www.hajim.rochester.edu\/senior-design-day\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.hajim.rochester.edu\/senior-design-day\/fingerprinting-vpn-traffic-an-evaluation-of-website-fingerprinting-attacks-on-modern-virtual-private-network-applications\/#primaryimage"},"image":{"@id":"https:\/\/www.hajim.rochester.edu\/senior-design-day\/fingerprinting-vpn-traffic-an-evaluation-of-website-fingerprinting-attacks-on-modern-virtual-private-network-applications\/#primaryimage"},"thumbnailUrl":"https:\/\/www.hajim.rochester.edu\/senior-design-day\/wp-content\/uploads\/2024\/04\/poster-cover.png","datePublished":"2024-04-23T20:12:33+00:00","dateModified":"2025-05-02T18:53:16+00:00","author":{"@id":"https:\/\/www.hajim.rochester.edu\/senior-design-day\/#\/schema\/person\/351018fbcf84ed8cac6d8072ba5b347c"},"description":"VPNs are increasingly promoted as a privacy-enhancing technology and a solution to protecting users\u2019 privacy from surveillance and cyber attacks. While most VPN protocols encrypt users\u2019 browsing traffic, the research community has repeatedly demonstrated that encryption algorithms need not be broken for malicious agents with knowledge of users\u2019 encrypted traffic to fingerprint the websites they visit. We investigate whether advancements in VPN technologies in the last two decades make VPNs harder to fingerprint.","breadcrumb":{"@id":"https:\/\/www.hajim.rochester.edu\/senior-design-day\/fingerprinting-vpn-traffic-an-evaluation-of-website-fingerprinting-attacks-on-modern-virtual-private-network-applications\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.hajim.rochester.edu\/senior-design-day\/fingerprinting-vpn-traffic-an-evaluation-of-website-fingerprinting-attacks-on-modern-virtual-private-network-applications\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.hajim.rochester.edu\/senior-design-day\/fingerprinting-vpn-traffic-an-evaluation-of-website-fingerprinting-attacks-on-modern-virtual-private-network-applications\/#primaryimage","url":"https:\/\/www.hajim.rochester.edu\/senior-design-day\/wp-content\/uploads\/2024\/04\/poster-cover.png","contentUrl":"https:\/\/www.hajim.rochester.edu\/senior-design-day\/wp-content\/uploads\/2024\/04\/poster-cover.png","width":2960,"height":1784},{"@type":"BreadcrumbList","@id":"https:\/\/www.hajim.rochester.edu\/senior-design-day\/fingerprinting-vpn-traffic-an-evaluation-of-website-fingerprinting-attacks-on-modern-virtual-private-network-applications\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.hajim.rochester.edu\/senior-design-day\/"},{"@type":"ListItem","position":2,"name":"Fingerprinting VPN Traffic: An Evaluation of Website Fingerprinting Attacks on Modern Virtual Private Network Applications"}]},{"@type":"WebSite","@id":"https:\/\/www.hajim.rochester.edu\/senior-design-day\/#website","url":"https:\/\/www.hajim.rochester.edu\/senior-design-day\/","name":"Senior Design Day","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.hajim.rochester.edu\/senior-design-day\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.hajim.rochester.edu\/senior-design-day\/#\/schema\/person\/351018fbcf84ed8cac6d8072ba5b347c","name":"admin","url":"https:\/\/www.hajim.rochester.edu\/senior-design-day\/author\/seniordesign\/"}]}},"_links":{"self":[{"href":"https:\/\/www.hajim.rochester.edu\/senior-design-day\/wp-json\/wp\/v2\/posts\/155002","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.hajim.rochester.edu\/senior-design-day\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hajim.rochester.edu\/senior-design-day\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hajim.rochester.edu\/senior-design-day\/wp-json\/wp\/v2\/users\/6242"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hajim.rochester.edu\/senior-design-day\/wp-json\/wp\/v2\/comments?post=155002"}],"version-history":[{"count":9,"href":"https:\/\/www.hajim.rochester.edu\/senior-design-day\/wp-json\/wp\/v2\/posts\/155002\/revisions"}],"predecessor-version":[{"id":179112,"href":"https:\/\/www.hajim.rochester.edu\/senior-design-day\/wp-json\/wp\/v2\/posts\/155002\/revisions\/179112"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.hajim.rochester.edu\/senior-design-day\/wp-json\/wp\/v2\/media\/179012"}],"wp:attachment":[{"href":"https:\/\/www.hajim.rochester.edu\/senior-design-day\/wp-json\/wp\/v2\/media?parent=155002"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hajim.rochester.edu\/senior-design-day\/wp-json\/wp\/v2\/categories?post=155002"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hajim.rochester.edu\/senior-design-day\/wp-json\/wp\/v2\/tags?post=155002"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.hajim.rochester.edu\/senior-design-day\/wp-json\/wp\/v2\/coauthors?post=155002"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}