An Incremental Website Fingerprinting Attacks for QUIC Traffic

TAN Jingwen; WANG Huanran; HAN Shuai; YANG Wu; QIN Kewei

doi:10.12263/DZXB.20251031

您当前的位置：

首页 >

文章列表页 >

An Incremental Website Fingerprinting Attacks for QUIC Traffic

Cutting\-edge Technologies for Encrypted Network Security | 更新时间：2026-07-30

- An Incremental Website Fingerprinting Attacks for QUIC Traffic
- ACTA ELECTRONICA SINICA Vol. 54, Issue 4, Pages: 1548-1561(2026)
- 作者机构：
  
  1.哈尔滨工程大学计算机科学与技术学院，黑龙江哈尔滨 150001
  2.中移系统集成有限公司，北京 100071
- 作者简介：
- 基金信息：
  
  National Natural Science Foundation of China(U22A2036;U21B2019;62272127;62572144);Natural Science Foundation Joint Guidance Project of Heilongjiang(LH2024F036);Natural Science Foundation High-level Talents of Hainan(622RC672)
- DOI：10.12263/DZXB.20251031
  CLC： TP393;
- Received：31 March 2026，
  
  Accepted：14 April 2026，
  
  Online First：25 May 2026，
  
  Published：25 April 2026
- 稿件说明：
移动端阅览
谭静文, 王焕然, 韩帅, 等. 面向QUIC的增量式网站指纹攻击方法[J]. 电子学报, 2026, 54(04): 1548-1561.

TAN Jingwen, WANG Huanran, HAN Shuai, et al. An Incremental Website Fingerprinting Attacks for QUIC Traffic[J]. Acta Electronica Sinica, 2026, 54(04): 1548-1561.
谭静文, 王焕然, 韩帅, 等. 面向QUIC的增量式网站指纹攻击方法[J]. 电子学报, 2026, 54(04): 1548-1561. DOI：10.12263/DZXB.20251031

TAN Jingwen, WANG Huanran, HAN Shuai, et al. An Incremental Website Fingerprinting Attacks for QUIC Traffic[J]. Acta Electronica Sinica, 2026, 54(04): 1548-1561. DOI：10.12263/DZXB.20251031

摘要

快速用户数据报协议网络连接（Quick UDP Internet Connections， QUIC）旨在提供快速、稳定且安全的网络服务，其加密特性为加密恶意网站提供了保护伞。为了监管QUIC流量中加密恶意网站，网站指纹攻击成为研究热点。QUIC协议的渐进式部署特点，使得对新启用QUIC协议的网站实施早期WF攻击至关重要。攻击者必须持续监控网站是否开始支持QUIC协议，并在其启用QUIC协议后及时爬取少量QUIC流量，快速训练新的攻击模型。这种攻击可被称为增量式小样本网站指纹攻击。然而，训练样本的匮乏使得现有深度学习方法难以构建有效的深度特征。同时，现有方法均面向TCP协议提取初始特征，但这些初始特征无法表达QUIC协议特性，导致无法充分表征QUIC流量。这些问题导致现有方法在进行增量式小样本网站指纹攻击时性能下降。为解决此问题，本文分析了QUIC协议的特有特征及其对WF攻击的重要性。引入QUIC特有特征后，能更全面地表征网站的QUIC流量。同时，提出基于图论的增量式小样本网站指纹攻击方法，从全局视角挖掘潜在特征关联性，进一步提升攻击模型的表征能力。为模拟监测列表中新启用QUIC网站的出现情况，以一个月为间隔爬取两组网站流量数据。通过综合实验评估了所提特征与方法在新收集的QUIC网站流量上的有效性。相较于现有的先进方法，本文提出的方法在准确率上提升了1.01%～6.84%。

Abstract

Quick UDP internet connections (QUIC) protocol has been proposed to provide fast

stable and secure web services. Its encryption properties provide a protective shield for malicious websites. To detect malicious websites in QUIC traffic

website fingerprinting (WF) attacks have become a research hotspot. As the QUIC protocol is being gradually implemented

it is essential to conduct an early and rapid WF attack for new QUIC-enabled websites. Attackers must continuously monitor whether websites begin supporting the QUIC protocol

once QUIC is enabled

crawl a small amount of QUIC traffic for rapid training of new attack models. This type of attack may be termed an incremental few-shot website fingerprinting attack. However

the scarcity of training samples renders existing deep learning methods ineffective in constructing effective deep features. Moreover

current methods extract initial features from the transmission control protocol

which fail to capture the characteristics of the QUIC protocol and thus inadequately represent QUIC traffic. These limitations result in existing methods performing poorly when conducting incremental few-shot website fingerprinting attacks under QUIC traffic. To address the issues

we analyze QUIC-specific characteristics and their importance for WF attacks. The addition of QUIC-specific characteristics provides a more comprehensive representation of the QUIC-enabled websites. Meanwhile

a graph-based few-shot incremental website fingerprinting attack method is proposed to mine the potential characteristic relevance from a global perspective. It further improves the representation ability of the attack models. To simulate the emergence of new QUIC-enabled websites in the monitored list

we crawl the traffic of two groups of websites one-month apart. We conduct comprehensive experiments to evaluate the effectiveness of the proposed characteristics and method in the collected QUIC-enabled website traffic. Compared to the state-of-the-art method

the accuracy of the proposed method is improved by 1.01%~6.84%.

关键词

Keywords

references

Langley A , Riddoch A , Wilk A , et al . The QUIC transport protocol: Design and internet-scale deployment [C ] // Proceedings of the Conference of the ACM Special Interest Group on Data Communication . New York : ACM , 2017 : 183 - 196 . DOI: 10.1145/3098822.3098842 http://dx.doi.org/10.1145/3098822.3098842

Basyoni L , Erbad A , Alsabah M , et al . QuicTor: Enhancing tor for real-time communication using QUIC transport protocol [J ] . IEEE Access , 2021 , 9 : 28769 - 28784 . DOI: 10.1109/access.2021.3059672 http://dx.doi.org/10.1109/access.2021.3059672

Kumar P , Dezfouli B . Implementation and analysis of QUIC for MQTT [J ] . Computer Networks , 2019 , 150 : 28 - 45 . DOI: 10.1016/J.COMNET.2018.12.012 http://dx.doi.org/10.1016/J.COMNET.2018.12.012

Shreedhar T , Panda R , Podanev S , et al . Evaluating QUIC performance over web, cloud storage, and video workloads [J ] . IEEE Transactions on Network and Service Management , 2022 , 19 ( 2 ): 1366 - 1381 . DOI: 10.1109/tnsm.2021.3134562 http://dx.doi.org/10.1109/tnsm.2021.3134562

Gui Xiaolin , Cao Yuanlong , Huang Longjun , et al . A survey of QUIC-based network traffic identification [C ] // Proceedings of the 12th International Conference on Mobile Networks and Management . Cham : Springer , 2023 : 365 - 372 . DOI: 10.1007/978-3-031-32443-7_26 http://dx.doi.org/10.1007/978-3-031-32443-7_26

Wang Tao , Goldberg I . Improved website fingerprinting on Tor [C ] // Proceedings of the 12th ACM Workshop on Privacy in the Electronic Society . New York : ACM , 2013 : 201 - 212 . DOI: 10.1145/2517840.2517851 http://dx.doi.org/10.1145/2517840.2517851

Zhan Mengqi , Li Yang , Zhu Yongchun , et al . Website-aware protocol confusion network for emergent HTTP/3 website fingerprinting [J ] . IEEE Transactions on Information Forensics and Security , 2023 , 18 : 2427 - 2439 . DOI: 10.1109/tifs.2023.3266173 http://dx.doi.org/10.1109/tifs.2023.3266173

Sirinam P , Mathews N , Rahman M S , et al . Triplet fingerprinting: More practical and portable website fingerprinting with n-shot learning [C ] // Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2019 : 1131 - 1148 . DOI: 10.1145/3319535.3354217 http://dx.doi.org/10.1145/3319535.3354217

Bhat S , Lu D , Kwon A , et al . Var-CNN: A data-efficient website fingerprinting attack based on deep learning [J ] . Proceedings on Privacy Enhancing Technologies , 2019 , 2019( 4 ): 292 - 310 . DOI: 10.2478/popets-2019-0070 http://dx.doi.org/10.2478/popets-2019-0070

Luxemburk J , Hynek K , Čejka T . Encrypted traffic classification: The QUIC case [C ] // Proceedings of 2023 7th Network Traffic Measurement and Analysis Conference . Piscataway : IEEE , 2023 : 1 - 10 . DOI: 10.23919/tma58422.2023.10199052 http://dx.doi.org/10.23919/tma58422.2023.10199052

Nie Mingjie , Zou Futai , Qin Yi , et al . QUIC-CNN: Website fingerprinting for QUIC traffic in Tor network [C ] // Proceedings of 2022 IEEE 24th International Conference on High Performance Computing & Communications . Piscataway : IEEE , 2022 : 663 - 671 . DOI: 10.1109/hpcc-dss-smartcity-dependsys57074.2022.00114 http://dx.doi.org/10.1109/hpcc-dss-smartcity-dependsys57074.2022.00114

Sirinam P , Imani M , Juarez M , et al . Deep fingerprinting: Undermining website fingerprinting defenses with deep learning [C ] // Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2018 : 1928 - 1943 . DOI: 10.1145/3243734.3243768 http://dx.doi.org/10.1145/3243734.3243768

Chen Mantun , Wang Yongjun , Xu Hongzuo , et al . Few-shot website fingerprinting attack [J ] . Computer Networks , 2021 , 198 : 108298 . DOI: 10.48550/arXiv.2101.10063 http://dx.doi.org/10.48550/arXiv.2101.10063

Panchenko A , Lanze F , Pennekamp J , et al . Website fingerprinting at internet scale [C ] // Proceedings of the 23rd Annual Network and Distributed System Security Symposium . San Diego, CA, USA : The Internet Society , 2016 : 1 - 5 . DOI: 10.14722/ndss.2016.23477 http://dx.doi.org/10.14722/ndss.2016.23477

Emmanuel T , Maupong T , Mpoeleng D , et al . A survey on missing data in machine learning [J ] . Journal of Big Data , 2021 , 8 ( 1 ): 236299679 . DOI: 10.1186/s40537-021-00516-9 http://dx.doi.org/10.1186/s40537-021-00516-9

Abe K , Goto S . Fingerprinting attack on Tor anonymity using deep learning [J ] . Proceedings of the Asia-Pacific Advanced Network , 2016 , 42 : 15 - 20 .

Rimmer V , Preuveneers D , Juarez M , et al . Automated website fingerprinting through deep learning [C ] // Proceedings of the 25th Annual Network and Distributed System Security Symposium . San Diego : The Internet Society , 2018 : 1 - 15 . DOI: 10.14722/ndss.2018.23105 http://dx.doi.org/10.14722/ndss.2018.23105

Wang Yanbin , Xu Haitao , Guo Zhenhao , et al . snWF: Website fingerprinting attack by ensembling the snapshot of deep learning [J ] . IEEE Transactions on Information Forensics and Security , 2022 , 17 : 1214 - 1226 . DOI: 10.1109/tifs.2022.3158086 http://dx.doi.org/10.1109/tifs.2022.3158086

Shen Meng , Ji Kexin , Gao Zhenbo , et al . Subverting website fingerprinting defenses with robust traffic representation [C ] // Proceedings of the 32nd USENIX Security Symposium . Anaheim, CA, USA : USENIX Association , 2023 : 607 - 624 .

Deng Xinhao , Li Qi , Xu Ke . Robust and reliable early-stage website fingerprinting attacks via spatial-temporal distribution analysis [C ] // Proceedings of the 2024 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2024 : 1997 - 2011 . DOI: 10.1145/3658644.3670272 http://dx.doi.org/10.1145/3658644.3670272

Shen Meng , Wu Jinhe , Ai Junyu , et al . Swallow: A transfer-robust website fingerprinting attack via consistent feature learning [C ] // Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2025 : 1574 - 1588 . DOI: 10.1145/3719027.3744795 http://dx.doi.org/10.1145/3719027.3744795

Deng Xinhao , Yin Qilei , Liu Zhuotao , et al . Robust multi-tab website fingerprinting attacks in the wild [C ] // Proceedings of 2023 IEEE Symposium on Security and Privacy . Piscataway : IEEE , 2023 : 1005 - 1022 . DOI: 10.1109/sp46215.2023.10179464 http://dx.doi.org/10.1109/sp46215.2023.10179464

Oh S E , Mathews N , Rahman M S , et al . GANDaLF: GAN for data-limited fingerprinting [J ] . Proceedings on Privacy Enhancing Technologies , 2021 , 2021( 2 ): 305 - 322 . DOI: 10.2478/popets-2021-0029 http://dx.doi.org/10.2478/popets-2021-0029

Dingledine R , Mathewson N , Syverson P . Tor: The second-generation onion router [R ] . Washington : Naval Research Lab , 2004 . DOI: 10.21236/ada465464 http://dx.doi.org/10.21236/ada465464

Zhou Guangmeng , Guo Xiongwen , Liu Zhuotao , et al . TrafficFormer: An efficient pre-trained model for traffic data [C ] // Proceedings of 2025 IEEE Symposium on Security and Privacy . Piscataway : IEEE , 2025 : 1844 - 1860 . DOI: 10.1109/sp61157.2025.00102 http://dx.doi.org/10.1109/sp61157.2025.00102

Xie Yi , Feng Jiahao , Huang Wenju , et al . Contrastive fingerprinting: A novel website fingerprinting attack over few-shot traces [C ] // Proceedings of the ACM Web Conference 2024 . New York : ACM , 2024 : 1203 - 1214 . DOI: 10.1145/3589334.3645575 http://dx.doi.org/10.1145/3589334.3645575

Chen Mantun , Wang Yongjun , Zhu Xiatian . Few-shot website fingerprinting attack with meta-bias learning [J ] . Pattern Recognition , 2022 , 130 : 108739 . DOI: 10.1016/j.patcog.2022.108739 http://dx.doi.org/10.1016/j.patcog.2022.108739

Lyu Qiuyun , Xie Huihui , Wang Wei , et al . TFAN: A task-adaptive feature alignment network for few-shot website fingerprinting attacks on Tor [J ] . Computers & Security , 2024 , 144 : 103980 . DOI: 10.1016/j.cose.2024.103980 http://dx.doi.org/10.1016/j.cose.2024.103980

Zou Hongcheng , Su Jinshu , Wei Ziling , et al . An efficient cross-domain few-shot website fingerprinting attack with Brownian distance covariance [J ] . Computer Networks , 2022 , 219 : 109461 . DOI: 10.1016/j.comnet.2022.109461 http://dx.doi.org/10.1016/j.comnet.2022.109461

Zhou Qiang , Wang Liangmin , Zhu Huijuan , et al . Few-shot website fingerprinting attack with cluster adaptation [J ] . Computer Networks , 2023 , 229 : 109780 . DOI: 10.1016/j.comnet.2023.109780 http://dx.doi.org/10.1016/j.comnet.2023.109780

Zhou Qiang , Wang Liangmin , Zhu Huijuan , et al . Joint alignment networks for few-shot website fingerprinting attack [J ] . The Computer Journal , 2024 , 67 ( 6 ): 2331 - 2345 . DOI: 10.1093/comjnl/bxae009 http://dx.doi.org/10.1093/comjnl/bxae009

Zhao Xiyuan , Deng Xinhao , Li Qi , et al . Towards fine-grained webpage fingerprinting at scale [C ] // Proceedings of the 2024 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2024 : 423 - 436 . DOI: 10.1145/3658644.3690211 http://dx.doi.org/10.1145/3658644.3690211

Shen Meng , Ye Ke , Liu Xingtong , et al . Machine learning-powered encrypted network traffic analysis: A comprehensive survey [J ] . IEEE Communications Surveys & Tutorials , 2023 , 25 ( 1 ): 791 - 824 . DOI: 10.1109/comst.2022.3208196 http://dx.doi.org/10.1109/comst.2022.3208196

Zhan Pengwei , Wang Liming , Tang Yi . Website fingerprinting on early QUIC traffic [J ] . Computer Networks , 2021 , 200 : 108538 . DOI: 10.1016/j.comnet.2021.108538 http://dx.doi.org/10.1016/j.comnet.2021.108538

RFC 9000 QUIC A UDP -based multiplexed and secure transport [S ] . DOI: 10.17487/rfc9000 http://dx.doi.org/10.17487/rfc9000

Kukreja S L , Löfberg J , Brenner M J . A least absolute shrinkage and selection operator (LASSO) for nonlinear system identification [J ] . IFAC Proceedings Volumes , 2006 , 39 ( 1 ): 814 - 819 . DOI: 10.3182/20060329-3-au-2901.00128 http://dx.doi.org/10.3182/20060329-3-au-2901.00128

Witsenhausen H , Wyner A . A conditional entropy bound for a pair of discrete random variables [J ] . IEEE Transactions on Information Theory , 1975 , 21 ( 5 ): 493 - 501 . DOI: 10.1109/tit.1975.1055437 http://dx.doi.org/10.1109/tit.1975.1055437

Wei Rongzhe , Yin Haoteng , Jia Junteng , et al . Understanding non-linearity in graph neural networks from the perspective of Bayesian inference [C ] // Proceedings of the 36th International Conference on Neural Information Processing Systems . New York : Curran Associates Inc. , 2022 : 2466 . DOI: 10.52202/068431-2466 http://dx.doi.org/10.52202/068431-2466

顾健华 , 冯建华 , 许辉阳 , 等 . 基于有向图与卷积网络强化学习的端侧协同算力资源分配方法 [J ] . 电子学报 , 2025 , 53 ( 6 ): 1771 - 1783 .

Gu Jianhua , Feng Jianhua , Xu Huiyang , et al . Directed graph and convolutional network reinforcement learning for terminal-side collaborative computing resource allocation scheme [J ] . Acta Electronica Sinica , 2025 , 53 ( 6 ): 1771 - 1783 . (in Chinese)

Cao Shaosheng , Lu Wei , Xu Qiongkai . GraRep: Learning graph representations with global structural information [C ] // Proceedings of the 24th ACM International Conference on Information and Knowledge Management . New York : ACM , 2015 : 891 - 900 . DOI: 10.1145/2806416.2806512 http://dx.doi.org/10.1145/2806416.2806512

Battaglia P W , Hamrick J B , Bapst V , et al . Relational inductive biases, deep learning, and graph networks [PP/OL ] . V3. arXiv ( 2018-10-17 )[ 2026-03-10 ] . https://arXiv.org/abs/1806.01261 https://arXiv.org/abs/1806.01261 .

Gahtan B , Shahla R J , Cohen R , et al . Exploring QUIC dynamics: A large-scale dataset for encrypted traffic analysis [C ] // Proceedings of 2025 IEEE International Mediterranean Conference on Communications and Networking . Piscataway : IEEE , 2025 : 1 - 6 . DOI: 10.1109/meditcom64437.2025.11104435 http://dx.doi.org/10.1109/meditcom64437.2025.11104435

Shen Meng , Ji Kexin , Wu Jinhe , et al . Real-time website fingerprinting defense via traffic cluster anonymization [C ] // Proceedings of 2024 IEEE Symposium on Security and Privacy . Piscataway : IEEE , 2024 : 3238 - 3256 . DOI: 10.1109/sp54263.2024.00247 http://dx.doi.org/10.1109/sp54263.2024.00247

Gong Jiajun , Wang Tao . Zero-delay lightweight defenses against website fingerprinting [C ] // Proceedings of the 29th USENIX Conference on Security Symposium . Berkeley : USENIX Association , 2020 : 717 - 734 .

Cai Xiang , Nithyanand R , Wang Tao , et al . A systematic approach to developing and evaluating website fingerprinting defenses [C ] // Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2014 : 227 - 238 . DOI: 10.1145/2660267.2660362 http://dx.doi.org/10.1145/2660267.2660362

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Remote Traffic Fingerprinting Attack Based on Cell Sequence Reconstruction

Research and Comparative Analysis of SSD Failure Prediction Methods Based on Machine Learning and Rule-Based Reasoning

ADPM-Based Secure Beamforming Design Method for Low-Altitude Integrated Sensing and Communication

A Broadband High-Linearity CMOS Low-Noise Amplifier for K/Ka-Band Applications

Joint User Association and Resource Optimization for Low-Altitude UAV Swarm-Based ILAC Networks

Related Author

SHI Jinqiao

WANG Xuebin

HUANG Wentao

LI Zeyu

LIU Kai

HUANG Junjie

TAN Jie

YANG Wenjing

Related Institution

Institute of Information Engineering, Chinese Academy of Sciences

School of Cyberspace Security, Beijing University of Posts and Telecommunications

School of Computer Science, Peking University

Strategic Assessments and Consultation Institute, Academy of Military Sciences

College of Computer, National University of Defense Technology

⁰