IUPTIS: Fingerprinting Profile Webpages in a Dynamic and Practical DPI Context

Abstract

In this paper, we propose an extended overview of a novel webpage fingerprinting technique ‘IUPTIS’ that allows an adversary to identify webpage profiles in an encrypted HTTPS traffic trace. Our approach works by identifying sequences of image resources, uniquely attributed to each webpage. Assumptions of previous state-of-the-art methods are reduced by developing an approach that does not depend on the browser utilized. Additionally, it outperforms previous methods by allowing webpages to be dynamic in content and permitting a limited number of browser and CDN-cached resources. These easy-to-use properties make it viable to apply our method in DPI frameworks where performance is crucial. With practical experiments on social media platforms such as Pinterest and DeviantArt, we show that IUPTIS is an accurate and robust technique to fingerprint profile webpages in a realistic scenario. To conclude, we propose several defenses that are able to mitigate IUPTIS in privacy-enhanced tools such as Tor.