| 摘要: |
| 现有Tor网络网站指纹识别方法在抵御流量混淆防御时面临已知类精度下降和未知类检出困难的双重挑战。在Walkie-Talkie和WTF-PAD等强防御机制下，流量模式与防御噪声相互耦合，传统模型的时序特征提取与分类决策能力严重受限。在开放世界场景中，现有方法对未知流量的检出率低、泛化性能差。为应对上述局限，本文提出CTAP-Net(Causal Temporal Attention Purification Network)，一种融合因果时空编码与对抗性去噪的端到端识别框架。该框架利用双层稀疏掩码实现局部时序约束与全局噪声抑制，通过对抗训练剥离防御引入的伪特征以恢复流量底层结构，并采用多任务联合优化协同重构、对抗与分类损失，同步增强已知网站识别与未知流量判别能力。实验在标准化公开数据集上验证，在封闭世界设定下，CTAP-Net在Walkie-Talkie防御下准确率达74.26%，较WF-Transformer和Var-CNN分别提升6.06和11.72个百分点；在WTF-PAD防御下准确率达89.15%，较两者分别提升7.81和16.47个百分点。在开放世界场景中，未知流量召回率为82.37%，宏观平均AUC达0.8974，验证了框架在已知类识别保持与未知类检出之间的有效平衡及在复杂Tor网络环境下安全监测的潜力。 |
| 关键词: Tor网络 网站指纹识别 CTAP-Net 流量分析 对抗鲁棒性 防御流量 |
| DOI： |
| 投稿时间：2026-04-28修订日期：2026-07-13 |
| 基金项目:国家重点研发计划项目(No. 2024YFB2907201)、河南省重大科技专项项目(No. 241110210200) |
|
| CTAP-Net: A Strong Anti-interference Method for Tor Website Fingerprinting |
|
Xu Depeng, Cheng Guozhen
|
| (Institute of Information Technonlogy, Information Engineering University) |
| Abstract: |
| Existing website fingerprinting methods for Tor networks face the dual challenge of degraded accuracy on known classes and low detection rates for unknown traffic when confronted with traffic obfuscation defenses. Under strong defenses such as Walkie-Talkie and WTF-PAD, genuine traffic patterns become entangled with defense-induced noise, severely constraining the temporal feature extraction and classification capabilities of conventional models. In open-world scenarios, existing methods exhibit poor generalization and low unknown traffic recall. To overcome these limitations, this paper proposes CTAP-Net (Causal Temporal Attention Purification Network), an end-to-end recognition framework that integrates causal spatiotemporal encoding with adversarial denoising. The framework employs a dual-layer sparse mask to enforce local temporal constraints while suppressing global noise, uses adversarial training to strip away defense-induced pseudo-features and recover the underlying traffic structure, and incorporates a multi-task joint optimization mechanism that coordinates reconstruction, adversarial, and classification losses, simultaneously enhancing both known-site recognition and unknown-traffic discrimination. Evaluated on standardized public datasets, CTAP-Net achieves 74.26% accuracy under Walkie-Talkie defense in the closed-world setting, outperforming WF-Transformer and Var-CNN by 6.06 and 11.72 percentage points, respectively; under WTF-PAD defense, it achieves 89.15% accuracy, outperforming them by 7.81 and 16.47 percentage points, respectively. In the open-world scenario, it attains an unknown traffic recall of 82.37% and a macro-average AUC of 0.8974, confirming the framework''s effectiveness in balancing known-class recognition retention with unknown-class detection and highlighting its potential for security monitoring in complex Tor network environments. |
| Key words: Website Fingerprinting CTAP-Net Tor Network Traffic Analysis Adversarial Robustness Defended Traffic |
