RAP: A Lightweight Application Layer Defense Against Website Fingerprinting

Website fingerprinting (WFP) attacks threaten user privacy on anonymity networks because they can be used by network surveillants to identify webpages that are visited by users based on extracted features from the network traffic. There are currently defenses to reduce the threat of WFP, but these defense measures have some defects; some defenses are too expensive to deploy, and some have been defeated by stronger WFP attack methods. In this work, we propose a lightweight application layer defense method,RAP, which can resist current WFP attacks with very low data and latency overheads; more importantly, it is easy to deploy. We randomly deploy important resource files, such as JS and CSS, to multiple Tor OR servers in advance and update them regularly. By randomly scrambling the resource request order, a single request is sent and received through multiple independent paths with different Tor entry ORs. To randomize the traffic distribution, users randomly obtain the website resource files directly from the Tor node server, rather than from the original server, when browsing the website. In this way, the best attack accuracy is reduced from 98% to 53%. Additionally, to confuse the traffic, we request a small amount of additional HTML text instead of the whole website resources, which reduces the effect of state-of-the-art WFP attacks to 40% with 13% data overhead and 31% latency overhead.