This article has been accepted for publication in a future issue of this journal, but has not been

fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TDSC.2020.2988369, IEEE
Transactions on Dependable and Secure Computing
1

Website Fingerprinting Through the Cache

Occupancy Channel and its Real World Practicality
Anatoly Shusterman, Zohar Avraham, Eliezer Croitoru, Yarden Haskal, Lachlan Kang, Dvir Levi, Yosef Meltser,
Prateek Mittal, Senior Member, IEEE, , Yossi Oren, Senior Member, IEEE, , and Yuval Yarom, Member, IEEE

Abstract—Website fingerprinting attacks use statistical analysis Past research has demonstrated that encrypting traffic is not
on network traffic to compromise user privacy. The classical sufficient for protecting the privacy of the users [12, 33, 39,
attack model used to evaluate website fingerprinting attacks 41, 42, 50, 51, 61, 69, 76, 77, 83, 103, 104, 109]. Observable
assumes an on-path adversary, who observes traffic traveling
between the user’s computer and the network. patterns in the metadata of encrypted traffic, specifically, the
In this work we investigate a different attack model, in which size of the transmitted data, its direction, and its timing, may
the adversary sends JavaScript code to the target user’s computer. reveal the web page that the user is visiting. Applying such
This code mounts a cache side-channel attack to identify other website fingerprinting techniques to Tor traffic results in a
websites being browsed. Using machine learning techniques to success rate of over 90% in identifying the websites that a
classify traces of cache activity, we achieve high classification
accuracy in both the open-world and the closed-world models. user visits over Tor [83].1
Our attack is more resistant than network-based fingerprinting In this paper, we focus on an alternative attack model of
to the effects of response caching, and resilient both to network- exploiting micro-architectural side-channels, a less explored
based defenses and to side-channel countermeasures. We carry option for website fingerprinting. The attack model assumes a
out a real-world evaluation of several aspects of our attack, victim that visits a website under the attacker’s control. The
exploring the impact of the changes in websites and browsers
over time, as well as of the attacker’s ability to guess the software website monitors the state of the victim computer’s cache, and
and hardware configuration of the target user’s computer. uses that information to infer the victim’s web activity in other
To protect against cache-based website fingerprinting, new tabs of the same browser or even in other browsers.
defense mechanisms must be introduced to privacy-sensitive Because the attack observes the internal state of the target
browsers and websites. We investigate one such mechanism, and PC, rather than the network traffic, it offers the potential of
show that it reduces the effectiveness of the attack and completely
eliminates it when used in the Tor Browser.
overcoming traffic shaping, often proposed as a defense for
website fingerprinting [13, 14, 18, 73, 105]. Similarly, the
attack may be applicable in scenarios where network-based
I. I NTRODUCTION fingerprinting is known to be less effective, such as when the
ver the last decades the World Wide Web has grown browser caches the contents of the website [41].
O from an academic exercise to a communication tool that
encompasses all aspects of modern life. Users use the web
We note that the malicious website does not need to be fully
under the control of the attacker. The attacker only needs to be
to acquire information, manage their finances, conduct their able to inject JavaScript code via the website to the victim’s
social life, and more. This shift to the so called virtual life browser. This can be done, for example, through a malicious
has resulted in new challenges to users’ privacy. Monitoring advertisement or a pop-up window. Alternatively, documents
the online behavior of users may reveal personal or sensitive released by former NSA contractor Edward Snowden indicate
information about them, including information such as sexual that some nation-state agencies have the operational capability
orientation or political beliefs and affiliations. to exploit this vector on a wide scale. In March 2013 the
Several tools have been developed to protect the online German magazine Der Spiegel reported on the existence of a
privacy of users and hide information about the websites they tool called QUANTUMINSERT, which the GCHQ and the NSA
visit [21, 23, 81]. Prime amongst these is the Tor network [23], could use to inject malicious code to any website [92]. The
an overlay network of collaborating servers, called relays, that Der Spiegel claims that the tool has been used to attack the
anonymously forward Internet traffic between users and web computers of employees at the partly-government-held Belgian
servers. Tor encrypts the network traffic of all of the users, and telecommunications company Belgacom and to target high-
transmits it between relays in a way that prevents external ranking members of the Organization of the Petroleum Ex-
observers from identifying the traffic of specific users. The porting Countries (OPEC) at the organization’s Vienna head-
Tor Project also provides the Tor Browser [97], a modified quarters. Finally, malicious advertisements are a viable option
version of the Firefox web browser, that further protects users for injecting cache side-channel attacks to browsers [32].
For a small number of websites, under the closed-world
by disabling features that may be used for tracking users.
model, Oren et al. [74] show the possibility of fingerprinting
A. Shusterman, Z. Avraham, E. Croitoru, Y. Haskal, D. Levi, Y. Meltser, via malicious JavaScript code. However, beyond showing the
and Y. Oren are with the Ben-Gurion University of the Negev
L. Kang performed this work while at the University of Adelaide 1 Website fingerprinting is a misnomer. Fingerprinting identifies individual
P. Mittal is with Princeton University web pages rather than sites. Following this misnomer, in this work we use
Y. Yarom is with the University of Adelaide and Data61 the term website to refer to specific pages, typically the homepage of the site.

1545-5971 (c) 2020 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See [Link] for more information.
Authorized licensed use limited to: University of Durham. Downloaded on June 22,2020 at 03:40:18 UTC from IEEE Xplore. Restrictions apply.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TDSC.2020.2988369, IEEE
Transactions on Dependable and Secure Computing

ability to distinguish between a handful of websites, their detect websites. We evaluate the attacker’s ability to probe
work does not provide an analysis of the effectiveness of the the hardware configuration of the target host, and show that
technique. Furthermore, following the disclosure of the Spectre the attack can be resilient to incorrect guess of the hardware
and the Meltdown attacks, which can also be potentially deliv- and software configuration of the target.
ered via malicious JavaScript injection [54, 65], major vendors More specifically, we make the following contributions:
deployed defenses against browser-borne side-channel attacks. • We design and implement the cache occupancy attack,
In particular, all modern browsers have reduced the resolution a cache-based side-channel attack technique which can
of the JavaScript time function, [Link](), by operate with the low timer resolution supported in modern
several orders of magnitude [79, 102]. Traditionally, cache JavaScript engines. Our attacks only require a sampling
attacks require high-resolution timers, and while mechanisms rate six orders of magnitude lower than required for the
to generate such timers in web browsers have been pub- prior attacks of Oren et al. [74] (Section IV).
lished [35, 55, 86], it is not clear that these can be used for
website fingerprinting. • We evaluate the use of two machine learning techniques,
Thus, in this paper we ask: Are cache-based attacks a viable CNN and LSTM, for fingerprinting websites based on
option for website fingerprinting? the cache activity traces collected while loaded by the
browsers (Section V).
Our Contribution • We show that cache-based fingerprinting has high accu-
We answer this question in the affirmative. We design racy in both the closed- and the open-world models, under
and implement a cache-based website fingerprinting attack a variety of operating systems and browsers (Section VI).
and evaluate it in both the closed-world and the open-world
• We evaluate network-based and cache-based fingerprint-
models. We show that in both models our JavaScript-based
ing with the browser response cache enabled, and show
attacker achieves high fingerprinting accuracy even when the
that while the accuracy of network-based fingerprinting
attack is carried out on modern mainstream browsers that in-
drops significantly, the accuracy of cache-based finger-
clude all recently introduced countermeasures for side-channel
printing is not affected (Section VII-C).
(Spectre) attacks. Even when taking these countermeasures to
the extreme, as is done in the Tor Browser, our attack remains • We show that cache-based fingerprints contain infor-
effective, although with a drop in accuracy. mation both from the network activity and from the
Our attack consists of collecting traces of cache occupancy rendering activity of the target device. Therefore, cache-
while the browser downloads and renders websites. Adapting based fingerprinting maintains a high accuracy even in the
the techniques of Rimmer et al. [83], we use deep neural presence of traffic molding countermeasures which force
networks to analyze and to classify the collected traces. By a constant bit rate on network traffic (Section VII-D).
focusing on cache occupancy rather than on activity within • We explore real-world implications, including evaluating
specific cache sets, our attack avoids the need for high resolu- the effects of concept drift and the importance of using
tion timers required by prior cache-based attacks. Furthermore, correct browser and cache size estimation on the finger-
because our technique does not depend on the layout of printing accuracy, as well as evaluating a technique for
the cache, it can overcome proposed countermeasures that automatically determining the cache size (Section VIII).
randomize the cache layout [66, 80, 106].
We investigate the source of the information in the cache • We design and evaluate a countermeasure that introduces
occupancy traces and show that they contain information from noise in the cache. The countermeasure is applicable from
both the networking activity and the rendering activity of both native code and from JavaScript and completely
the browser. Using information from the rendering activity blocks the attack on the Tor Browser, with a small
allows our attack to remain effective even in scenarios that performance degradation. (Section IX).
thwart network-based fingerprinting, such as when the browser
II. BACKGROUND
retrieves data from its response cache and not from the
network, or when the network traffic is shaped. A. Tor
We implement a potential countermeasure that introduces a Tor [23], is a collection of collaborating servers called re-
high level of activity into the last level cache. We show that lays, designed to provide privacy for network communication.
the countermeasure reduces the success rate of the attack. In Tor aims to protect users from on-path adversaries that can
particular, the noise completely masks the activity of the Tor observe the network traffic. In this scenario, a user uses a
Browser, reducing the attack accuracy to that of a random PC to browse the web, and an adversary positioned between
guess. This countermeasure results in a mean slowdown of the user’s PC and the destination web server captures the
5% for CPU benchmarks, which we consider reasonable when information that the user exchanges with the web server.
visiting privacy-sensitive web sites. A common protection for such an attack model is to use
Finally, we investigate several aspects that affect the real- encryption, e.g., using protocols such as TLS [22] which
world applicability of the attack. We show that changes in underlies the security of the HTTPS scheme [82]. However,
websites over time result in a gradual drop in the accuracy this solution only protects the contents of the communication,
of the attack, whereas the mere act of updating the browser leaving the identity of the communicating parties exposed
may result in significant drop in the ability to accurately to the adversary. Merely knowing that users connected to a

2
1545-5971 (c) 2020 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See [Link] for more information.
Authorized licensed use limited to: University of Durham. Downloaded on June 22,2020 at 03:40:18 UTC from IEEE Xplore. Restrictions apply.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TDSC.2020.2988369, IEEE
Transactions on Dependable and Secure Computing

certain sensitive website may be enough to incriminate them, approach, proposed by Zhuo et al. [114], uses a Profile Hidden
even if the actual data exchanged over the secure connection Markov Model (PHMM) [57]. This method builds a profile
is not known. This risk became a reality in 2016, as tens out of a network trace of visiting a home-page of a website,
of thousands of individuals were persecuted by the Turkish followed by deeper pages of the same site. It then calculates
government for accessing the domain [Link] [56]. the probabilities of a label given a sequence of network traces,
The main aim of Tor is thus to protect the identity of the while treating the probabilistic noise inside each network trace.
communicating parties. Tor achieves this protection by for-
warding the users’ communication through a circuit consisting C. Cache Side-Channel Attacks
of typically three Tor relays. The user encrypts the network
When programs execute on a processor, they share the use of
traffic with multiple layers of encryption, and each relay in the
micro-architectural components such as the cache. This shar-
circuit decrypts a successive layer to find out where to forward
ing may result in unintended communication channels, often
the traffic. See Dingledine et al. [23] for further information.
called side channels, between programs [31, 44], which may
be used to leak secret information. In particular, cache-based
B. Website Fingerprinting Attacks and Defences attacks, which exploit contention on one of the processor’s
In the conventional attack model of a network-level attacker, caches, can leak secrets such as cryptographic keys [4, 30, 75,
much previous work has demonstrated the ability of an adver- 78, 98], keystrokes [36], address layout [27, 35, 37], etc.
sary to make probabilistic inferences about users’ communi- Cache Operation. Caches bridge the speed gap between
cations via statistical analysis, even if these communications the faster processor and the slower memory. The cache is a
are in their encrypted form. These works have investigated small bank of memory, which stores the contents of recently
both the selection of features (such as packet sizes, packet accessed memory locations. Most caches in modern processors
timings, direction of communication), as well as the design are set associative. The cache is divided into partitions called
of classifiers (such as Support Vector Machines, Random sets. Each memory location maps to a single set and can only
Forests, Naive Bayes) to make accurate predictions [12, 33, be cached in the set it maps to. When the processor needs to
39, 41, 42, 50, 51, 61, 69, 76, 77, 83, 103, 104, 109]. In access a specific memory location, it successively searches in
response, several defense mechanisms have been proposed in a hierarchy of caches. In a cache hit, when the contents of the
the literature [5, 13, 14, 18, 73, 105]. The common idea behind required address is found in the cache, access is performed on
these defenses is to inject random delays and spurious cover the cached contents. Otherwise, in a cache miss, the process
traffic to perturb the traffic features and therefore obfuscate repeats on the next cache level. A miss on the last-level cache
users’ communications. A common point of all of these (LLC) results in a time-consuming access to the RAM.
defenses is a typical trade-off between latency/bandwidth and The Prime+Probe Technique. Past cache-based attacks
privacy, and thus they face deployment hurdles. Rimmer et from web browsers [32, 74] employ the Prime+Probe tech-
al. [83] have recently proposed a family of classifiers based nique [75, 78], which exploits the set-associative structure.
on deep learning algorithms such as SDAE, CNN and LSTM, Each round of attack consists of three steps. In the first step,
which operate on the raw network traces, and are therefore the cache is primed, i.e., the attacker completely fills some of
less sensitive to ad-hoc defenses against particular traffic the cache sets with their own data. The attacker then waits
features. Following this work, Sirinam et al. [90] proposed some time to allow the victim to execute. Finally, the attacker
different CNN architectures that outperform previous attacks probes the cache by measuring the time it takes to access
on Tor Browser, and that can withstand the WTF-PAD [52] the previously-cached data in each of the sets. If the victim
countermeasure that modifies traffic characteristics. accesses memory locations that map to a monitored cache set,
One of the drawbacks of previous works is the high number the victim’s memory contents will replace the attacker contents
of traces required per website. To address this, Bhat et al. [7] in the cache. Hence, the attacker will need to retrieve the
propose a neural network with a ResNet [40] architecture, data from lower levels in the hierarchy, increasing the access
for high accuracy classification using a small amount of time to its data. Prime+Probe has been used for attacks on
data of packet timing information. Their experiments use data [75, 78] and instruction [3, 4] caches, as well as for
only 100 traces per website, achieving results comparable to attacks on the LLC [48, 67]. It has been shown practical in
previous works which use thousands of traces. Sirinam et al. multiple settings, including across different virtual machines
[91] suggest another approach, using N-Shot learning [60]. in cloud environments [45] and from mobile code [32, 74].
Their approach compares pairs of feature traces for same and Countermeasures in JavaScript. The time difference
different websites. It outputs a feature vector which is matched between the latencies of a memory access and cache access
against other output vectors of traces with known labels, and is on the order of 0.1 µs. To distinguish between cache hits
classified to the most similar traces. and misses, cache attacks typically require a high resolution
Another limitation of many website fingerprinting works timer. Following the first demonstration of a cache attack
is the single-tab surfing assumptions. To overcome this lim- in JavaScript [74], some browsers reduced the resolution of
itation, Xu et al. [108] proposed a classifier, combining the the timers they provide. This approach had become wide-
Balance-Cascade [68] method and the XGBoost [16] classifier, spread after the disclosure of the Spectre attack [54], and
which finds the split point at which a second webpage is loaded now all mainstream browsers incorporate this countermeasure.
in another tab, and then classifies the first website. A different Furthermore, while non-traditional timers in browsers have

3
1545-5971 (c) 2020 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See [Link] for more information.
Authorized licensed use limited to: University of Durham. Downloaded on June 22,2020 at 03:40:18 UTC from IEEE Xplore. Restrictions apply.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TDSC.2020.2988369, IEEE
Transactions on Dependable and Secure Computing

been identified [29, 55, 86], browsers and extensions have a cache occupancy channel can detect keystroke timing and
since disabled many of the features that allow sub-microsecond network load in co-located virtual machines on cloud servers.
resolution [71, 79, 87]. In particular, the Tor Browser restricts Both use the technique with high resolution (sub nanosecond)
the timer resolution to 100 ms, or 10 Hz. timers. We are not aware of any prior use of the cache
Several of the previously discovered timers rely on browser occupancy channel to overcome low resolution timers.
features that are accessible from JavaScript. These are not
accessible in environments such as Cloudflare Workers [9], III. T HE W EBSITE F INGERPRINTING ATTACK M ODEL
which rely on the absence of high-resolution timers to protect
against timing attacks [100].
Target PC

D. Related Work
Sensitive
Several past works have looked at the possibility of per- Target Target Browser Adversary Website
Secure Network
forming website fingerprinting based on local side-channel
information. In all of these works, which we survey in Table I, Figure 1: The classical website fingerprinting attack model.
the adversary observes some property of the system while the The (passive) adversary monitors the traffic between the target
victim browser is rendering a webpage. The adversary then user and the secure network.
applies a machine learning classifier to the observed side-
channel trace to identify the rendered website.2 Some of these The classical attack model used to evaluate website finger-
works assume that the adversary has malicious control over printing attacks is presented in Figure 1. Here, the victim uses
a hardware component or peripheral [19, 64, 110]. Others a web browser to display a sensitive website. To protect their
assume that the adversary can execute arbitrary native code on privacy, the victim does not connect to the website directly,
the target hardware [38, 49, 58, 70, 94]. Yet others only assume but instead uses a secure network, such as the Tor network,
that the adversary can induce the victim to render a webpage for the connection. The attacker is typically modeled as an on-
containing malicious JavaScript code [10, 53, 70, 74, 101]. path adversary, who is capable of observing all traffic entering
We mainly investigate the last model. and leaving the Tor network in the direction of the target user.
Kim et al. [53] abuse a data leak in the Chrome imple- The adversary cannot understand the contents of the network
mentation of the Quota Management API, which has been traffic since it is encrypted when it enters the Tor network.
since fixed. Our attack, in contrast, is based on a fundamental The adversary is furthermore unable to directly determine the
property of the CPU running the browser application, which is ultimate destination of the communications after it exits the
far less trivial to fix (see Section IX). Moreover, the mitigations Tor network, thanks to Tor’s routing protocol. Finally, due
put in place as part of the response to the Spectre and to the encryption and the validation of the Tor network, the
Meltdown disclosures make the high sampling rates exploited attacker is unable to modify the traffic without terminating the
thus far [74, 101] unattainable in modern secure browsers. connection. An important thread of research on the security of
Our attack, in contrast, achieves high accuracy at drastically Tor has investigated the ability of such an adversary to perform
lower sampling rates and is capable of classifying a significant statistical traffic analysis of encrypted traffic, and then to
number of websites at sampling rates as low as 10 Hz. To the make probabilistic inferences about the victim’s communica-
best of our knowledge, no cache attack that uses such low tions [12, 39, 41, 42, 50, 51, 61, 69, 76, 77, 83, 103, 104, 109].
clock resolutions has been demonstrated. Gong et al. [33] suggest a variation on this scheme, in which
In addition, Oren et al. [74] only recorded a small number the attacker remotely probes routers to estimate the load of
of traces from a few popular websites, and did not investigate the network traffic they process and performs the statistical
the effectiveness of cache-based fingerprinting in open-world analysis based on this estimate. Jansen et al. [50] suggest
contexts, or in scenarios where various anti-fingerprinting another variation in which the attacker monitors the traffic
measures are in place. We address all of these shortcomings in inside the Tor network, rather then at the network’s edge.
this work. Furthermore, while Oren et al. [74] do target the Tor In this work we discuss a different attack model, presented
Browser, the attack code executes in a different mainstream in Figure 2. In this model, the target user has two concur-
browser. Unlike our work, they do not demonstrate an attack rent browsing sessions. In one session, the user browses to
from JavaScript code running within the Tor Browser. an adversary-controlled site, which contains some malicious
Booth [10] is able to classify a moderate amount of websites JavaScript code. In the other session, the user browses to
using a non-cache-based method with a millisecond clock. some sensitive website. Due to architectural boundaries, such
Their attack, however, saturates all of the victim’s CPU as sandboxing or process isolation, the malicious code cannot
cores with math-intensive worker threads, making it highly directly observe the internal state of the sensitive session.
noticeable and easy to detect by the victim. Hence, the adversary cannot directly determine the destination
Cock et al. [20] implement a covert channel using an L1 of any communication issued from the sensitive session, even
cache occupancy channel. Ristenpart et al. [84] show that when the sensitive session is using a direct unencrypted
2 A different but closely related class of attacks are “history sniffing” attacks,
connection to the remote server. The malicious code can,
such as [62, 107], in which the attacker wishes to learn which websites the however, observe the micro-architectural state of the processor,
victim has visited in the past. and use this information to spy on the sensitive session.

4
1545-5971 (c) 2020 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See [Link] for more information.
Authorized licensed use limited to: University of Durham. Downloaded on June 22,2020 at 03:40:18 UTC from IEEE Xplore. Restrictions apply.
 Table I: Related work on website fingerprinting based on local side channels.

Sampling
Work Target Side Channel Attack Model rate [Hz]
Clark et al., 2013 [19] Chrome (Mac, Win, Linux) Power consumption Hardware 250000
Yang et al., 2017 [110] Multiple smartphones Power consumption Hardware 200000
Lifshits et al., 2018 [64] Android Browser, Chrome Android Power consumption Hardware 1000
Jana and Shmatikov, 2012 [49] Chrome Linux, Firefox Linux, Android Browser (VM) App memory footprint Native code 100000
Lee et al., 2014 [58] Chromium Linux, Firefox Linux GPU memory leaks Native code N/A
Spreitzer et al., 2016 [94] Chrome Android, Android Browser, Tor Android Data-Usage Statistics Native code 20–50
Gülmezoglu et al., 2017 [38] Chrome Linux (Intel and ARM), Tor Linux Performance counters Native code 10000
Matyunin et al., 2019 [70] Multiple smartphones Magnetometer Native code 10–100
and JavaScript
Oren et al., 2015 [74] Safari MacOS, Tor MacOS Last-level cache JavaScript 108
Booth, 2015 [10] Chrome (Mac, Win, Linux), Firefox Linux CPU activity JavaScript 1000
Kim et al., 2016 [53] Chromium Linux, Chrome (Win, Android) Quota Management API JavaScript N/A
Vila and Köpf, 2017 [101] Chromium Linux, Chrome Mac Shared event loop JavaScript 40000
This work Chrome (Win, Linux), Firefox (Win, Linux), Safari Last-level cache JavaScript 10–500
MacOS, Tor Linux

Target PC multaneously run one browsing session over an unsecured

connection for mundane tasks, and another browsing
session over a second, secured connection for sensitive
Adversary

Standard Session
Standard
Website
tasks. An attacker capable of modifying traffic on the
Architectural
standard link can learn about activity carried out over
Boundary
the secured link, whether this secure connection made
through a VPN, through the Tor network, or even through
Sensitive
a separate network adapter which the attacker cannot see.
Target Sensitive Session Website
Secure Network The main challenge of our attack model is the extremely
restricted JavaScript runtime, which requires the attacker code
Figure 2: Remote cache-based website fingerprinting attack
to be written in a particular way, as described in Section IV.
model. The remote attacker injects malicious JavaScript code
Regardless of the delivery vector, cache-based fingerprinting
into a browser running on the target machine.
has a strong potential advantage over network-based finger-
printing, since it can indirectly observe both the computer’s
network activity and the browser’s rendering process. As
Our attack can therefore be considered in two scenarios: we demonstrate in Section VII-D, both of these elements
• A cross-tab scenario, where a user is made to contribute to the accuracy of our classifier.
visit an attacker-controlled website containing malicious
JavaScript, and this website tries to learn what other IV. DATA C OLLECTION
sensitive sites the user is visiting at the same time. These A. Creating memorygrams
attacker-controlled and sensitive browsing sessions can The raw data trace for network-based attacks takes the form
be carried out on the same browser, on two different of a network trace, commonly in the pcap file format, which
browsers belonging to the same user, or even on two contains a timestamped sequence of all traffic observed on
browsers residing in two completely isolated virtual ma- a certain network link. The corresponding data trace in the
chines which share the same underlying hardware [85]. case of cache attacks is the memorygram [74]—measured
One possible way of causing the user to browse to such at a constant sampling rate over a given time period. The
an attacker-controlled site is through a phishing attack, memorygrams of Oren et al. [74] describe the latency of
where the attacker sends fraudulent messages, purporting multiple individual sets or groups of sets at each point in time,
to be from a benign source, that induces the victim to resulting in a two-dimensional array. In contrast, in this work
click on a link to a malicious website. Alternatively, the we use a simplified, one-dimensional memorygram form. The
attacker may pay an advertisement service to display a contents of each entry in our memorygrams is a proxy for the
(malicious) advertisement when the user visits a third- occupancy of the cache at the specific time period. We collect
party website [32]. memorygrams while the browser loads and displays websites,
• A cross-network scenario, where the attacker is an active and use the data as fingerprints for website classification.
on-path adversary capable of injecting JavaScript into any The Cache Occupancy Channel. Unlike prior works [32,
non-encrypted page. The attacker would like to leverage 74], which use the Prime+Probe side-channel attack from
that access to try to learn about the user’s sensitive JavaScript, we use a cache occupancy channel. The main
activity, even though the attacker cannot manipulate or difference is that the Prime+Probe attack measures contentions
access this traffic directly. For example, the user may si- in specific cache sets, whereas our attack measures contention

5
Authorized licensed use limited to: University of Durham. Downloaded on June 22,2020 at 03:40:18 UTC from IEEE Xplore. Restrictions apply.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TDSC.2020.2988369, IEEE
Transactions on Dependable and Secure Computing

over the whole cache. Specifically, our JavaScript attack al- allocation patterns. Consequently, the location at which data
locates an LLC-sized buffer and measures the time to access is allocated changes each time a page is downloaded, and the
the entire buffer. The victim’s access to memory evicts the location carries little information on the downloaded page. In
contents of our buffer from the cache, introducing delays for practice, not having spatial information is also an advantage.
our access. Thus, the time to access our buffer is roughly Without it, there is no need to build eviction sets for cache
proportional to the number of cache lines that the victim uses. sets, a process that can take significant time [32].
Cache occupancy has previously been implemented in native Website Memorygrams. We capture memorygrams when
code and used for covert channels and for measuring co- the browser navigates to websites and displays them. We use
resident activity [20, 84]. Both of these implementations rely a JavaScript-based memorygrammer to probe the cache at a
on high resolution timers. We are not aware of any prior use fixed rate of one sample every 2 ms. We continue the probe
of the cache occupancy channel with a low resolution timer. for 30 seconds, resulting in a vector of length 15,000. When
Native-code and JavaScript Memorygrammers. The a probe takes longer than 2 ms, we miss the slot of the next
results in this paper compare two different memorygramming probe. We use a special value to indicate this case. We use
methods – a native-code memorygrammer based on the Mastik this collection method for all mainstream browsers other than
toolkit [111], which is written in C, and a portable code the Tor Browser.
memorygrammer, which is written in JavaScript. While both When the attack code is launched from within the Tor
the native-code memorygrammer and the JavaScript memory- Browser, where the timer resolution is limited to 100 ms, we
grammer run without super-user permissions, the native-code do not measure how long a sweep over the cache takes, but
memorygrammer offers several advantages to the attacker. instead count how many sweeps over the entire cache fit into
First and foremost, the native-code memorygrammer has ac- a single 100 ms time slot. In addition, we do not probe for 30
cess to high-resolution timers, on the order of nanoseconds, seconds in this setting, but rather for 50 seconds, to account
and is also able to query the CPU’s internal performance for the slower response time over the Tor network. Hence,
monitoring counters. The JavaScript memorygrammer, in con- Tor memorygrams contain 500 measurements over the entire
trast, has more limited timer access. Another advantage of the 50 second measurement time period.
native-code memorygrammer is its direct access to memory. The native-code memorygrammer used for the evaluations
While the native-code memorygrammer, which is running in in Section VII does not suffer from a reduced timing resolution
user mode, cannot completely map between its virtual address when measuring the Tor Browser. Therefore, on mainstream
space and physical memory, it can still determine the LLC browsers it runs for 30 seconds and produces 15,000 entries,
cache set responsible for each memory location in its own and on the Tor Browser it runs for 50 seconds and produces
address space. This is due to the use of the “huge pages” 25,000 entries.
memory mapping mode, in which the lowest 21 bits of the
virtual address are equal to those of the physical address. The Wikipedia
JavaScript memorygrammer, in contrast, is unable to directly
access memory, neither virtual nor physical, and relies on
accesses to JavaScript array objects, whose base address is
completely unknown to the attacker. We therefore consider
the native-code results to be a form of upper bound on the
Github
performance of the cache occupancy channel, against which
the JavaScript results can be compared.
Overcoming Hardware Prefetchers. Ideally, we would like
to collect information across the whole cache. Intel processors,
however, try to optimize memory accesses by prefetching
Oracle
memory locations that the processor predicts will be accessed
in the future. Because prefetching changes the cache state, we
need to fool the prefetchers. To fool the spatial prefetcher [47],
we use the technique of Yarom and Benger [112] and do not
probe adjacent cache sets. To fool the streaming prefetcher,
which tries to identify sequences of cache accesses, we use a Figure 3: Examples of memorygrams. Time progresses from
common approach of masking access patterns by randomizing left to right, darker shades correspond to more evictions.
the order of the memory accesses we perform [67, 75].
Spatial Information. Compared with the Prime+Probe Sanity Check. Before proceeding, we want to verify that
attack, the cache occupancy channel does not provide any memorygrams can be used for fingerprinting. Indeed, Figure 3
spatial information. That is, the adversary does not learn shows graphical representations of memorygrams of three
any information on the addresses that the victim accesses. sites: Wikipedia ([Link] Github (https:
While this is a clear disadvantage of the cache occupancy //[Link]), and Oracle ([Link] col-
channel, our attack does not require spatial information. The lected through the native-code memorygrammer. Each memo-
main reason is that modern browsers have complex memory rygram is displayed as a colored strip, where time goes from

6
1545-5971 (c) 2020 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See [Link] for more information.
Authorized licensed use limited to: University of Durham. Downloaded on June 22,2020 at 03:40:18 UTC from IEEE Xplore. Restrictions apply.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TDSC.2020.2988369, IEEE
Transactions on Dependable and Secure Computing

left to right and the shade corresponds to cache activity (darker to receive and render the webpage. Recognizing the start of
shades correspond to more evictions). We see that the three a trace may therefore be more difficult in the cache-based
memorygrams of each site, while not identical, are similar setting than in the network-based setting, especially in the
to each other. The memorygrams of different websites are, case of a real attack. Our framework implicitly synchronizes
however, very different from each other. This indicates that the trace with the start of the download. Due to varying
memorygrams may be used for identifying websites. network conditions, we see differences of up to six seconds
between trace start and render start. As such, we believe
B. Datasets that our technique can identify websites even without the
synchronization. Further experimentation is required, however,
Closed World Datasets. We evaluate our cache-based to verify this fact. We also note that if the machine is otherwise
fingerprinting on six different combinations of browsers and idle, cache activity can serve as a (slightly noisy) indicator of
operating systems, summarized in Table II. Many early works the start of the trace.
on website fingerprinting operated under a closed world as- Hardware Diversity. Despite the diversity of CPU gen-
sumption, where the attacker’s aim is to distinguish among erations and configurations evaluated in this work, we only
accesses to a relatively small list of websites. Our closed used Intel CPUs. While in principle the cache contention
world datasets follow this line of work. These datasets consist attack is agnostic of the specific structure of the cache, more
of 100 traces each for a set of 100 websites, to a total of experiments are needed to verify its effectiveness on other
10,000 memorygrams. We use the same list of 100 websites CPU architectures, such as Arm and AMD.
that Rimmer et al. [83] selected from the top Alexa sites.
Full Cache Eviction. Our JavaScript code allocates a buffer
Similar to previous works, no traffic molding is applied and
of the size of the victim’s LLC, and repeatedly accesses it
only one tab is opened at a time.
to observe cache occupancy. In Section VIII-D we evaluate
Open World Datasets. One common criticism of the the adversary’s ability to correctly estimate the size of the
closed world assumption is that it requires the attacker to cache. The question remains, however, as to whether a single
know the complete set of websites the victim is planning to pass over this buffer will cause it to fill up the whole LLC,
visit, allowing the attacker to prepare and train classifiers for evicting all other entries. Unless the cache uses a true LRU
each of these websites. This assumption was challenged by policy, some entries may not be replaced in a single pass over
many authors, for example Juárez et al. [51]. To address this the buffer. Worse, the mapping from virtual addresses used by
criticism, website fingerprinting methods are often evaluated the program to physical addresses used to index the cache is
in an open-world setting. In this setting, the attacker wishes to unlikely to be uniform. In Section VIII-C we show that the
monitor access to a set of sensitive websites, and is expected attacker does not need to have an exact coverage of the cache
to classify them with high accuracy. Additionally, there is a for the attack, hence we believe that full cache eviction is not
large set of non-sensitive web pages, all of which the attacker necessary for the attack.
is expected to generally label as “non-sensitive”.
To evaluate our fingerprinting method in the open-world
V. M ACHINE L EARNING
settings, we augment the closed-world datasets with additional
5,000 traces, each collected for a single unique website, again A. Problem Formulation
using the list of websites provided by Rimmer et al. [83]. The Website fingerprinting is generally formulated as a super-
base rate for this setting is 33.3%, since a trivial classifier can vised learning problem, consisting of a template building step
simply decide that all pages are non-sensitive. and an attack step. In the template building step, the adversary
visits each target website multiple times and collects a set
C. Limiting Assumptions of labeled traces (either network traces or memorygrams),
each corresponding to a visit to a certain website. Next, the
As noted by Juárez et al. [51], many academic works that
adversary trains a classifier on these labeled traces, using either
deal with website fingerprinting make assumptions on the
classical machine learning methods or deep learning methods.
conditions of the attacker and the system under attack that
In the attack step, the adversary is presented with a set
are different from those encountered outside the lab. Our
of unlabeled traces, each one corresponding to a visit to an
threat model and data collection protocol also makes several
unknown website. The adversary then applies the previously
assumptions, as listed below.
trained classifier to each of these traces and outputs a guess for
Synchronization. Each trace in our data set contains a each trace. The accuracy of the classifier is finally calculated
single web browsing session, from beginning to end. A real- as the percentage of the correctly assigned labels.
world attacker would be faced with a continuous trace where
the beginning and end of browsing sessions is not clearly
marked, and in which multiple browsing sessions may overlap. B. Deep Learning Models
In the network-based website fingerprinting scenario, little to Early works on website fingerprinting, starting from Cheng
no traffic travels through the network unless the user is actively and Avnur [17], used classical machine learning methods such
fetching a webpage. This makes the task of synchronization as Naive Bayes, Support Vector Machine (SVM) and k-Nearest
relatively easy. In the cache-based scenario, however, the cache Neighbors (KNN). As a prerequisite step to running these
is always active to a degree, even before the browser starts classical machine learning methods, the adversary needs to

7
1545-5971 (c) 2020 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See [Link] for more information.
Authorized licensed use limited to: University of Durham. Downloaded on June 22,2020 at 03:40:18 UTC from IEEE Xplore. Restrictions apply.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TDSC.2020.2988369, IEEE
Transactions on Dependable and Secure Computing

apply an additional feature extraction step which transforms both by its inputs and by the value of this memory cell. This
the raw trace into a more succinct representation. Since these allows the classifier to identify patterns in time-based data.
features were chosen through human insight into the nature Hyperparameter Selection. Hyperparameters describe the
of network traffic, there was no immediate way of directly overall structure of the DNN and of each layer. The choice
applying them to memorygram analysis. of hyperparameters depends on the specific classification
Abe and Goto [2] and later Rimmer et al. [83] suggest problem. For network-based fingerprinting, we replicated the
using deep learning for website fingerprinting. Deep learn- parameters specified in the dataset provided by Rimmer et
ing performs automatic feature learning from the raw data, al. [83]. For cache-based fingerprinting, we manually evaluated
reducing the reliance on human insight at the cost of a larger several choices for each hyperparameter.
required training set. Rimmer et al. [83] show that, given a To prevent overfitting, we use 10-fold cross validation. We
large enough training set, deep-learning website-fingerprinting split each dataset into 10 folds of equal size, and select one
approaches are as effective as earlier methods. An advantage fold, as a test set. The remaining 90% of the traces are used
of this approach is that it allows us to compare network-based for training the classifier, with 81% serving as the training set
and cache-based fingerprinting operating directly on the raw and 9% as the validation set. The model trains on the training
data, rather than on a specific choice of features. set and the evaluation is done on the test set. The number of
epochs is regulated with an Early-Stop function which stops
Deep Neural Network Configuration. A deep neural
the epochs when the accuracy of the validation set no longer
network (DNN) is typically configured as a sequence of non-
increases over successive iterations.
linear layers which transform the raw data, first extracting
For the CNN classifier we use three pairs of convolution
salient features and then selecting the appropriate ones [34].
and max pooling layers. For the LSTM classifier we use two.
Every layer in a DNN consists of a set of artificial neurons,
As discussed above, the traces captured by the code running
each connected to a set of outputs from the previous layers.
within the Tor Browser contain only 500 measurements, due
At the forward propagation stage, the activation function is
to the reduced timer resolution. For these shorter traces, we
applied to the product of the each neuron’s input and its weight
modified the architecture of our LSTM-based classifier. The
value, and then forwarded to the next layer. As a last layer,
feature selection of this classifier contains only one convolu-
we use a softmax layer, which outputs a vector containing
tion layer. We therefore used a pool-size of three for the max-
a-posteriori probabilities for each of the classes.
pooling layer to limit the feature reduction before the LSTM
The process of training the neural network uses back-
layer. In addition, because of the small amount of features, we
propagation to update the weights of each neuron to achieve
could increase the number of LSTM units to 128 and learn
a minimum loss at the output. First, the model calculates the
more complex patterns. The full hyperparameter tuning space
cost between the true classification of the measurement and the
is described in Shusterman et al. [88, Appendix A].
predicted value using a loss function. Next, the model updates
the weights of the each neuron based on the calculated loss.
Every round of forward propagation and back-propagation is VI. R ESULTS
called an epoch. A neural network model runs multiple epochs All of the results in this section were obtained by using
to learn the weights for accurate classification. Keras version 2.1.4, with TensorFlow version 1.7 as the back
We evaluate deep learning using two classifier models, end, running on two Ubuntu Linux 16.04 servers, one featuring
Convolutional Neural Networks (CNN) and Long Short-Term two Xeon E5-2660 v4 processors the other two Xeon E5-2620
Memory (LSTM) networks [43]. A CNN uses a sequence v3, both with 128 GB RAM. Our machine learning instances
of feature mapping layers alternating between convolutions took approximately 40 minutes to run in this configuration.
and max-pooling. Each of the layers sub-samples the previous Table II presents the fingerprinting accuracy we obtain.
layer, iteratively reducing the size of the input to a more suc- Recall that in this scenario the JavaScript interpreter of the
cinct representation, while preserving the information they en- targeted browser executes the memorygrammer. Considering
code. Each convolutional layer is a neural network specialized that all modern browsers reduced their timer resolution and
for detecting complex patterns in its input. The convolution some added jitter as a countermeasure for the Spectre at-
layer applies several filters to the input vector, each of which is tack [79, 102], the first question we need to address is whether
designed to identify an abstract pattern in a sequence of input it is even possible to implement cache-based fingerprinting
elements it is provided with. The max-pooling layers reduce attacks in such an environment.
the dimensionality of the data by subsampling the filters, To answer this question, we measured the latencies of the
choosing the maximum value from adjacent groups of neurons cache occupancy channel as the browser was rendering a rep-
applied by the filters. This alternating sequence of layers resentative webpage, using the native code memorygrammer.
extracts complicated features from the input and produces The measurement was made on a desktop computer featuring
vectors short enough for the classifiers. The feature mapping an Intel Core i5-25006 CPU at 3.30 GHz with 6 MB last-
layers are followed by a dense layer, in which every neuron level cache, running CentOS 7.2.1511. Figure 4 shows the
is connected to every output of the feature extraction phase. cumulative distribution function (CDF) of the latencies of the
The LSTM-based network has an initial feature selection step 14,632 samples collected while rendering the Facebook home
similar to the CNN, but then adds a layer in which each neuron page ([Link] The figure also highlights the
has a memory cell, with the output of this neuron determined timer resolutions of three mainstream browsers. (See Table II.)

8
1545-5971 (c) 2020 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See [Link] for more information.
Authorized licensed use limited to: University of Durham. Downloaded on June 22,2020 at 03:40:18 UTC from IEEE Xplore. Restrictions apply.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TDSC.2020.2988369, IEEE
Transactions on Dependable and Secure Computing

Table II: Accuracy obtained by in-browser memorygrammerdeviation.

Operating LLC Timer Closed World Open World
System CPU Size Browser Resolution CNN LSTM CNN LSTM
Linux i5-2500 6 MB Firefox 59 2.0 ms 78.5±1.7 80.0±0.6 86.8±0.9 87.4±1.2
Linux i5-2500 6 MB Chrome 64 0.1 ms 84.9±0.7 91.4±1.2 84.3±0.7 86.4±0.3
Windows i5-3470 6 MB Firefox 59 2.0 ms 86.8±0.7 87.7±0.8 84.3±0.6 87.7±0.3
Windows i5-3470 6 MB Chrome 64 0.1 ms 78.2±1.0 80.0±1.6 86.1±0.8 80.6±0.2
Mac OS i7-6700 8 MB Safari 11.1 1.0 ms 72.5±0.7 72.6±1.3 80.5±1.0 72.9±0.9
Linux i5-2500 6 MB Tor Browser 7.5 100.0 ms 45.4±2.7 46.7±4.1 60.5±2.2 62.9±3.3
Linux i5-2500 6 MB Tor Browser 7.5 (top 5) 100.0 ms 71.9±2.1 70.0±1.7 80.4±1.7 82.7±1.8

As we can see, even at the 2 ms resolution of the Firefox 59 assuming both attacks capture the same amount of traces
timer, it is possible to distinguish between 80% of the probes per website. As in the network-based setting, we believe that
which take less than 2 ms and the remaining 20%. This is capturing more than 100 traces per website is likely to increase
a welcome side-effect of the use of a large buffer which is the accuracy and the stability of our classifier.
accessed at every probing step. None of the cache probes
we measured, however, took longer than the 100 ms clock
B. Open World Results
period of the Tor Browser. Hence, when running within the
Tor Browser, we count the number of probes we can perform We next turn into a different scenario of open-world dataset.
within each clock tick. (See Section IV.) Recall that in this scenario the classifier needs to distinguish
between 101 classes. These include one class for each of the
1.0
100 sensitive websites, as well as one generic non-sensitive
Fraction of Samples

0.8 class for all 5000 websites not included in the sensitive classes.
The best strategy for a random classifier in this case would
Chrome 64

Safari 11.1

Firefox 59

0.6
0.4 be to always classify all traces as non-sensitive, providing a
0.2
CDF of Latency
base accuracy rate of 33%. As seen in Table II, the accuracies
0.0 the classifiers achieve in this case are 70–90%, slightly better
0 1 2 3 4
Latency (msec)
results than in a closed-world scenario. The reason might be
that the classifier easily recognizes the non-sensitive class that
Figure 4: Cache probe latencies vs. browser timer resolutions. includes 33% of the traces in the dataset.
If we group all of the sensitive classes into a meta-class of
The next question is whether the information we collect “sensitive websites”, the classification between sensitive vs.
with such a low resolution is sufficient for fingerprinting. non-sensitive sites becomes a binary classification problem.
Indeed, Table II shows that in all of the environments we We can, therefore, apply standard analysis techniques to this
test our classifier is significantly better than a random guess. aspect of the results. Using this labelling, we achieved a near
Remarkably, as our results show, even the highly restricted Tor perfect classification in all of the open world settings we
Browser can be used for mounting cache attacks, albeit with evaluated, achieving an area under curve (AUC) of more than
a significantly lower accuracy than that mainstream browsers. 99% in all cases, meaning that there is minimal confusion
between these two groups.
A. Closed World Results
Table III: Average precision and recall obtained by in-browser
We first look at the typical closed-world scenario investi- memorygrammer for LSTM model in open-world setting.
gated by past works. In mainstream browsers, our JavaScript
attack code is consistently able to provide classification ac- Operating System Browser Precision Recall
curacies of 70–90%, well over the base rate of 1%. The Tor Linux Firefox 59 87.1±0.3 84.8±0.4
Browser attack, however, achieves a lower accuracy of 47%. Linux Chrome 64 94.8±1.4 94.0±1.3
Windows Firefox 59 92.9±0.4 91.9±4.3
Yet, if we look not only at the top result output by the classifier, Windows Chrome 64 91.7±2.4 88.5±0.4
but also check whether the correct website is one of the top Mac OS Safari 11.1 80.0±0.5 77.3±0.6
five detected websites, the accuracy of the Tor Browser attack Linux Tor Browser 7.5 57.8±0.3 55.7±3.6
climbs to 72%, with a base rate of 5%. This method of looking
at the few most probable outputs of a classifier was previously Another set of metrics we can use are the average preci-
used in similar classification problems [15, 72]. With some a- sion and recall our classifiers achieve across all 101 classes.
TP
priori information an attacker can deduce which of the top five Precision for a class is defined as TP+FP , where TP is
pages the victim has accessed. the number of true positives, i.e. the number of traces of
We can compare the accuracy of our cache-based finger- the class for which the classifier correctly detects the class,
printing to the one obtained by state-of-the-art network-based and FP is the number of false positives, i.e. the number
methods, as reported by Rimmer et al. [83]. We see that while of traces of other classes that the classifier claims belong
TP
there are differences between the classification accuracies to the measured class. Recall is defined as TP+FN , with
achieved in each case, the overall accuracy is comparable, FN being the number of false negatives—traces of the class

9
1545-5971 (c) 2020 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See [Link] for more information.
Authorized licensed use limited to: University of Durham. Downloaded on June 22,2020 at 03:40:18 UTC from IEEE Xplore. Restrictions apply.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TDSC.2020.2988369, IEEE
Transactions on Dependable and Secure Computing

that the classifier misclassifies. We calculate the precision and scenarios contains 100 traces for each of the 100 URLs in a
the recall for each class separately and report the simple, closed-world setting, with memorygram traces and associated
unweighted average, to avoid bias toward the majority class. network traces for comparison.
Table III shows the results for the LSTM classifier, which
in our experiments performs better than others. As shown B. Baseline Scenario
in the table, the classifier achieves recall rates of 77–94%
Our baseline scenario replicates the results of our closed-
and precisions of 80–95% for mainstream browsers. For the
world JavaScript memorygrammer, as well as some of the
Tor Browser, the precision and recall are 56% and 58%
results of Rimmer et al. [83]. As we can see in Table IV,
respectively, slightly worse than for mainstream browsers, but
the native-code memorygrammer gives a slightly better accu-
still significantly better than the base rate.
racy than the JavaScript memorygrammer on Firefox. When
attacking the Tor Browser, the native-code memorygrammer
VII. ROBUSTNESS T ESTS achieves much better results than the in-browser JavaScript
We now turn our attention to the robustness of our website code. We believe that the cause of the improvement is the
fingerprinting technique and test its resilience to issues known higher probing accuracy afforded by the native-code memory-
to affect network-based fingerprinting. grammer. In both browsers, we achieve similar results to those
achievable with network-based fingerprinting.
A. Evaluation Setup
C. Enabling the Response Cache
Network-based fingerprinting methods, by definition, must
Collection Host
rely on network traffic to perform classification. Typically,
due to caching, many web pages are loaded with partial
or no network traffic. As specified in RFC 7234 [28], the
Memorygrammer
performance of web browsers is typically improved by the
use of response caches. When a web browser client requests a
remote resource from a web server, the server can specify that
a particular response is cacheable, and the web browser can
Test Harness Network Tracer
Target Browser
Network
then store this response locally, either on disk or in memory.
When the page is next requested, the web browser can ask
Figure 5: Data Collection Setup for the Robustness Tests. the server to send the response only if it has been modified
since the last time it was accessed by the client. In the case
To compare the results of network fingerprinting with cache- of a response cache hit, the server only returns a short header
based fingerprinting, we need to modify our data collection instead of the complete remote resource, resulting in a very
setup. The setup, illustrated in Figure 5, consists of two data short network traffic sequence. In some cases, the client can
collection hosts. The memorygram collection host, which sim- even reuse the cached response without querying the server for
ulates the victim’s machine, runs both the target browser and a remote copy, resulting in no network traffic at all. Herrmann
the memorygrammer software. The network tracer sits on-path et al. [41] demonstrate a significant decrease in the accuracy
between the memorygram collection host and the Internet, and of web fingerprinting when the browser uses the response
collects a record of the network traffic. A test harness written cache. Indeed, deleting or disabling the browser cache prior
in Perl and Python invokes the memorygrammer, the network to fingerprinting attacks is a common practice [76, 103].
tracer and the target browser at the same time, then saves We enable caching of page contents by the browser, and
a correlated data record consisting of the memorygram, the measure the effect on fingerprinting accuracy. In the Firefox
network trace in pcap format, and a screenshot of the target browser we simply refrain from clearing the response cache
web page for monitoring purposes. For data collection, we between sessions. For privacy reasons, the response cache in
use HP Elite 8300 desktop computers featuring Intel Core i5- the Tor Browser does not persist across session restarts. Hence,
2500 CPUs at 3.30 GHz, with a 6 MB last-level cache, running when collecting data on the Tor Browser we “prime” the cache
CentOS 7.2.1511 and either Firefox 59 or Tor Browser 7.5. before every recording by opening the web page in another tab,
For the robustness tests we use a native-code memorygram- allowing it to load for 15 seconds, then closing the tab.
mer, which is based on the Prime+Probe implementation of When we keep the browser’s response cache, the advantage
Mastik, a side-channel toolkit released under the GNU Public of cache-based website fingerprinting emerges. As Table IV
License [111]. We apply two modifications to the Mastik code. shows, the accuracy of the standard network-based methods
First, we change the Prime+Probe code to measure cache degrades when caching is enabled. We can see a degradation
occupancy rather than activity in specific cache sets. Secondly, in accuracy of over 20% in the fingerprinting accuracy. In
we use the processor’s performance counters [46] to count the contrast, the cache-based methods are largely unaffected by
number of cache evictions rather than use the high resolution the reduction in network traffic, achieving high accuracy
timer to identify evictions. The use of performance counters rates. This result supports the conclusion that the cache-
for attack purposes has already been proposed and investigated based detection methods are not simply detecting the CPU
in the past [8, 11, 59, 99]. Every dataset of the following activity related to the handling of network traffic, making them

10
1545-5971 (c) 2020 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See [Link] for more information.
Authorized licensed use limited to: University of Durham. Downloaded on June 22,2020 at 03:40:18 UTC from IEEE Xplore. Restrictions apply.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TDSC.2020.2988369, IEEE
Transactions on Dependable and Secure Computing

Table IV: Accuracy obtained in robustness tests — Mean (percents) and Standard deviation.
Firefox Network Firefox Cache Tor Network Tor Cache
Test CNN LSTM CNN LSTM CNN LSTM CNN LSTM
Baseline 86.4±1.0 93.2±0.5 94.9±0.5 94.8±0.5 77.6±1.6 90.9±0.7 72.7±0.7 80.4±0.5
Response cache enabled 56.1±1.5 70.6±1.5 92.2±0.8 92.2±0.5 55.5±1.7 65.9±1.0 86.1±0.5 86.3±0.6
Render only – – – – 1.0±0.0 1.0±0.0 63.3±1.1 63.9±1.5
Network only – – – – 77.6±1.6 90.9±0.7 19.9±1.8 51.9±2.7
Concept drift – – – – 64.5±2.2 81.0±0.6 68.3±0.5 75.6±0.7

essentially a special case of network-based classifiers, but are only detects the correct website in about 20% of the cases,
rather detecting rendering activities of the browser process. significantly lower than the 73% we get for the matching
closed-world scenario, but still much better than the 1%
D. Net-only and Render-only Results expected for a random guess. The accuracy of the network-
based classifier is the same as for the baseline, simply because
Oren et al. [74] show that cache activity is correlated with
the network traffic is replicated.
network activity, suggesting that cache-based fingerprinting
Combining these two experiments, we conclude that cache-
identifies the level of network activity. To rule out this pos-
based fingerprinting identifies features both in the network
sibility and show that website rendering also contributes to
traffic patterns and in the contents of the displayed web pages.
fingerprinting, we separate rendering (or more precisely, data
processing) activity from handling of network data. VIII. R EAL W ORLD P RACTICALITY
Render-Only Fingerprinting. To capture the data processing
Previous sections show that cache-based website fingerprint-
activity, we neutralize the network activity by guaranteeing
ing attacks can have a high accuracy. However, these attacks
constant traffic levels. More specifically, we apply molding
are carried out in a lab environment, and may not achieve the
to the network traffic, ensuring that data flow between the
same success in a real-world environment, where the attacker
collection host and the network at a fixed bandwidth of 10 KB
does not know the victim’s machine configuration or browser
every 250 ms. To achieve that, we queue data transmitted at a
version, or where some time has passed between the training
higher rate, or send dummy packets when the transmitted data
phase and the attack phase. In this section we investigate
does not fill the desired bandwidth. These dummy packets are
the feasibility of our attack in these more realistic scenarios.
silently dropped by the receiver. The approach is, basically,
Specifically, we look at the effects and implications of concept
BuFLO [25], with τ = ∞, i.e., when the data stream continues
drift between training and testing, unknown browser, and
indefinitely. This approach has a high bandwidth overhead
unknown cache size.
compared to WTF-PAD and WT, however, it is designed to
ensure that the network traffic is constant irrespective of the
contents of the website. As expected, the raw network captures A. Effect of Concept Drift
in this scenario all have the exact same size, which happens Juárez et al. [51] note that the accuracy of network-based
to be twice as large as the largest network capture recorded website fingerprinting declines as time passes between training
without traffic molding. set collection and the collection of data for performing the
Because all the traces are identical, the network-based website fingerprinting attack. They attribute the decline both
classifier assigns the same class to all of the traces, and its to changes to the websites and changes to the version of
accuracy is the same as a random guess. The results of cache- browser the users use. We now proceed to evaluate the effects
based fingerprinting show a drop in accuracy compared with of concept drift on the accuracy of our cache-based attack,
unmolded traffic. However, the accuracy is still significantly including both causes of change.
better than a random guess. This experiment demonstrates the Methodology: We apply the methodology of Section IV to
resilience of cache-based website fingerprinting to mitigation collect multiple closed-world datasets. During a period of 20
techniques aimed at network-based fingerprinting, and sug- weeks, we collect weekly datasets, each dataset containing 100
gests that this privacy threat may require different mitigation traces for every 100 closed-world website. Our memorygram
techniques, as we explore further in Section IX. collection platform features an Intel Core i5-3470 processor
Network-Only Fingerprinting. In a complementing exper- with 6 MB LLC, running CentOS 7.6 operating system. In the
iment, we aim to capture only the network traffic. To collect first 13 weeks we use Firefox version 60.7. After 13 weeks, we
this dataset, we first capture traffic data from a real browsing upgrade to version 60.8 using the yum system update utility.
session. We then use a mock setup, that does not involve a We use five of the datasets, collected four weeks apart of
browser at all. Instead, we use two tcpreplay [1] instances, each other, in weeks 2, 6, 10, 14, and 18, to train five models,
one at the collection host, and the other at a server, to emulate one for each of the datasets. The training uses 10-fold cross
the network traffic, replaying the data from the pcap file. validation on the traces from the dataset. We then test how
We find that the cache-based classifier can classify many well each of the five models classifies the traces in each of
pages even in the absence of rendering activity. However, the the 20 datasets collected for the experiment.
accuracy is significantly lower than in the case that rendering Results: Figure 6 shows the results of our experiment. Each
activity does take place. In particular, our CNN classifier of the five lines shows the accuracy of one of the models. The

11
1545-5971 (c) 2020 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See [Link] for more information.
Authorized licensed use limited to: University of Durham. Downloaded on June 22,2020 at 03:40:18 UTC from IEEE Xplore. Restrictions apply.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TDSC.2020.2988369, IEEE
Transactions on Dependable and Secure Computing

1.0 Train Dataset Week: 2 6 10 14 18

0.8
Accuracy

0.6

0.4

0.2

0.0
1 5 10 15 20
Test Dataset Week

Figure 6: Concept Drift – Effects of time difference between collecting training and test data.

horizontal axis shows the week the test dataset was collected Results: The experiment shows the importance of matching
at and the vertical axis is the model’s classification accuracy. the browser used for collecting the training data to the target
As expected, each model achieves its best performance at browser. Figure 7 shows the accuracy of the four models
the week in which it is collected. We further see that, with we trained when tested against the data from each browser,
the exception of week 13, the decline in model accuracy is and against the combined dataset. The vertical axis specifies
quite moderate. For example, the model collected in week 2 the browser used for collecting the training dataset, while the
still achieves over 47% in week 13. (Compared with 84% horizontal axis is the browser used for collecting the testing
in week 2 and 1% base rate). This compares well with the dataset. Accuracy is presented both numerically and by using
results of Juárez et al. [51], who note with network-based darker shades for higher accuracy.
fingerprinting the accuracy drops to under 50% within less The results show that training on a single browser only
than ten days. However, the browser upgrade in week 13 has allows fingerprinting on the same browser. With cross-browser
a significant impact on the accuracy of the models. Models classification, the results are close to random, achieving the
based on data collected before the change do poorly on data base rate accuracy of 1%. Nonetheless, with a training set that
collected after the change and vice versa. Although we used includes data collected on all browsers, the accuracy is almost
the Firefox browser as a case study, the concept drift of data as high as with training on each specific browser. Thus, one
traces is influenced by both webpage changes and browser model can suffice for cross-browser classification, provided
updates. Therefore, we expect the problem to also appear in that the model is trained with data from all browsers.
Google Chrome and in the Tor Browser.
C. Effect of Cache Size Misestimation
B. Cross-Browser Fingerprinting
The cache occupancy attack we use assumes we know the
Different browsers use different algorithms for downloading target computer’s cache size. Presumably, using too small
and presenting pages. As such, we expect different browsers a buffer might fail to force cache contention, whereas too
to produce different signatures for the same website. At the large a buffer would cause evictions regardless of the victim’s
same time, for attack efficiency, it is desired to minimize the activity. To validate this assumption, we measure the effect of
number of models created for different scenarios. One option an incorrectly estimated last-level cache size on fingerprinting
is to create a single training dataset which would learn over accuracy, by creating datasets in which the buffer size differs
all possible types of browser software. We now investigate the from the actual cache size.
relationship between the browsers and the attack efficiency. Methodology: We collect traces with incorrectly estimated
cache sizes. We use a host with an Intel Core i5-3470 pro-
Table V: System Setup for the Cross-Browser Experiment.
cessor, with a 6 MB last-level cache, running CentOS 7.6 and
Browser OS CPU LLC Firefox 60.8. We collect three datasets, each with a different
Firefox 60.8 Linux i5-2500 6 MB
“guess” of a cache size, reflected in the size of the buffer we
Chrome 77 Windows i5-3470 6 MB use for the cache occupancy attack. One guess is the correct
Safari 11.1 Mac OS i7-6700 8 MB cache size of 6 MB. The other guesses are a smaller and a
larger cache (4 MB and 8 MB). We train an LSTM model on
Methodology: We test the sensitivity of classifiers to the each of these datasets, using a 10-fold cross validation with
browser used for collecting the training sets. We further test 90% of the traces used for training and 10% for testing. We
whether a single classifier can correctly identify websites evaluate the models against each of the collected datasets.
irrespectively of the browser used by the victim. We collect Results: Figure 8 shows that as long as we use the same
traces on three hosts, summarized in Table V. On each host, buffer size for both the training and the test sets, the accuracy
we collect our closed-world dataset and use the data to build of the classifier is high. However, if the model is trained
four models. Three of the models are trained on a dataset with one estimation and tested with a different estimation,
collected on one of the hosts. The fourth model is trained the results are close to a random guess. Surprisingly, correctly
with the combined data of all three datasets. We use 10-fold guessing the cache size is less important than matching the
cross validation for the evaluation. guess between the training and testing sets. That is, the cache

12
1545-5971 (c) 2020 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See [Link] for more information.
Authorized licensed use limited to: University of Durham. Downloaded on June 22,2020 at 03:40:18 UTC from IEEE Xplore. Restrictions apply.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TDSC.2020.2988369, IEEE
Transactions on Dependable and Secure Computing

Estimated Cache Size

Firefox 82.6 3.0 1.1 28.9 3MB 61.5 30.8 5.1 2.6 0
4MB 84.0 1.0 1.0

Train Buffer Size

Train Browser

4MB 39.5 36.8 21.1 2.6 0

Chrome 1.4 72.2 1.8 24.8
6MB 1.5 82.0 1.0 6MB 0 30 60 10 0
Safari 0.8 0.9 72.5 24.7
8MB 0 0 33.3 33.3 33.3
All 82.2 67.5 68.6 72.7 8MB 1.0 1.3 80.9
9MB 0 0 0 0 0

Firefox Chrome Safari All 4MB 6MB 8MB 3MB 4MB 6MB 8MB 9MB
Test Browser Test Buffer Size Last-level Cache Size

Figure 7: Classifier accuracy with differ- Figure 8: Cache size misestimation clas- Figure 9: Real-world accuracy of the
ent browser combinations. sifiers performance. LLC size detection code.

occupancy attack is not too sensitive and works well with Target PCs
Wireless AP MITM Server HTTP Websites
wrong estimations of the cache size.

D. Cache Size Estimation

In this section we evaluate the adversary’s ability to cor-
Figure 10: Physical setup of the real-world experiment.
rectly estimate the size of the cache. We start with a lab
experiment on machines under our control and follow with
a real-world experiment on users’ machines. participating students provided the ground-truth hardware con-
Initial Lab Experiment: In our initial lab experiment [88], figuration of their computers, including the MAC addresses,
we created a JavaScript program that allocates a 20 MB array used for identifying the computer, and the last-level cache size.
in memory and iterates over it in several patterns which should Because most traffic the students accessed was encrypted, we
fit in well into different configurations of cache set-counts and ended up asking participants to also visit the non-encrypted
associativities. We then recorded the minimum, maximum and website [Link] to ensure we can inject the code.
mean access time per element, plus the standard deviation, for Ethical Considerations: The experiment design allows
each of these configurations. We collected 1,350 such measure- us access to participants’ web browsing activity. To address
ments from multiple systems with cache sizes of 3 MB, 4 MB, potential ethical issues, we made sure to limit the amount of
6 MB, and 8 MB. We then used MATLAB’s classification information we record. Specifically, we recorded the URLs of
learner tool to apply a variety of machine learning classifiers to accessed websites, but not their contents. We kept track of the
the measured data. Using both KNN and SVM classifiers, we MAC address of the participants’ computers, but did not store
were able to correctly classify the configuration of the target’s any personally identifying information that can link specific
last-level cache with over 99.8% classification accuracy under participants to their computers. Finally, sensitive websites,
5-fold cross validation. Interestingly, even a simple tree-based such as health or banking websites, were not likely to be
classifier which compared the minimum iteration time of intercepted, because these are likely to be encrypted.
three different configurations to a predefined threshold was Participation in the experiment was voluntary. Students
99.6% accurate. We ported this simple tree-based classifier were briefed about the procedure and the implications of
to JavaScript, creating an LLC cache size detector which we the experiment, were asked to provide written consent before
tested and found capable of accurately detecting the cache participating, and were given the option not to participate.
sizes of 15 different machines with diverse browser, hardware Participating students received one bonus point in the final
and operating system configurations, taking less than 300 ms grade of an undergraduate course. Prior to conducting the
to run in all cases. We thus concluded that generic attacks that experiment we sought and received approval from the Ben-
adapt to the specific hardware configuration seems feasible. Gurion University’s Institutional Review Board (IRB).
Real-world Cache Size Detection: For our real-world
Table VI: Machine Configurations for Real-World Experiment
experiment we set up a custom-designed man-in-the-middle
(MITM) environment that injects the cache-size estimation Property Value
code to the users’ browsers. In this setup, shown in Figure 10, Operating System Windows: 82, Linux: 1, Mac OS: 6, Android: 1
users connect to the Internet via a wireless access point. Traffic Browser Chrome: 81, Edge: 1, Firefox: 3, Safari: 1, Unknown: 4
between the access point and the Internet is filtered by a CPU Generation Gen 2 (Sandy Bridge) to Gen 5 (Broadwell): 21, Gen 6
(Skylake): 42, Gen 7 (Kaby Lake): 18, Gen 8 (Coffee
MITM server, implemented as an Internet Content Adaptation Lake): 9
Protocol (ICAP) [26] in a Squid-Cache proxy server [96]. Last-Level Cache 3 MB: 39, 4 MB: 29, 6 MB: 17, 8 MB: 4, 9 MB: 1
The MITM server monitors access to non-encrypted websites,
and injects the JavaScript code that performs the cache size Results: Table VI summarizes the hardware and software
estimation to the accessed pages. configurations of the participating computers. The vast major-
Experiment: We conducted the experiment during an under- ity of the participants used Chrome browser on Windows, and
graduate programming “hackathon”. Prior to the experiment, featured a wide diversity of Intel CPU micro-architectures,

13
1545-5971 (c) 2020 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See [Link] for more information.
Authorized licensed use limited to: University of Durham. Downloaded on June 22,2020 at 03:40:18 UTC from IEEE Xplore. Restrictions apply.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TDSC.2020.2988369, IEEE
Transactions on Dependable and Secure Computing

spanning from Generation 2 (Ivy Bridge) all the way to accuracy of our classifier is at or below the base rate of 1%
Generation 8 (Coffee Lake). for the closed-world scenario and 33% for the open-world
Figure 9 shows the data segmentation by the cache sizes. scenario. We also evaluate a scenario in which the adversary is
From this figure, we can understand besides the accuracy, allowed to train on traces with the countermeasure applied. In
the true positive rate and the false positive rate of each this more challenging scenario, the countermeasure completely
classification. The x-axis shows the ground truth of the LLC thwarts the attack when the attack code is running from the
size, as collected from the participants. The y-axis shows the Tor Browser. On Firefox, however, we only notice a moderate
possible classification results from the injected code. The data reduction in the effectiveness of the attack. In the closed-world
inside the confusion matrix shows us the probability to get scenario, the attack achieves an accuracy of 73%, and in the
each estimate given the ground-truth size. As the figure shows, open-world, 77%. (Down from 79% and 86%, respectively.)
the real-world performance of the cache size detection code Performance Impact. To understand the effect that our
is considerably worse than under ideal conditions, but it still countermeasure has system performance, we use the industry-
performs much better than a random guess. We conjecture that standard SPEC CPU benchmark [93], the de-facto standard
the lower accuracy may stem from the difference between the benchmark for measuring the performance of the CPU and the
training setup (a standalone web page in the lab setup) and memory subsystems. Figure 11 shows the results of the SPEC
the testing setup (a MITM injected script in the real-world CPU 2006 benchmarks with our countermeasure, relative to
experiment). The accuracy may be increased by training the no countermeasure. The countermeasure causes a slowdown
classifier under more realistic conditions, or by extending the of around 5% (geometric mean across the benchmarks) with
testing time beyond 300 milliseconds. a worst case slowdown of 14% for the bwaves benchmark.
These results are from the average of ten executions of the
IX. C OUNTERMEASURES benchmarks for each case. With Tor network performance
We now discuss potential countermeasures to our finger- being as it is, we believe that the performance hit on CPU
printing attack. We first describe a cache masking technique benchmarks is acceptable for this scenario.
we experimented with. We then follow with a review of other
cache attack countermeasures suggested in the literature. B. Other Countermeasures
Most of the past research into cache attacks has been done in
A. Cache Activity Masking
the context of side-channel cryptanalysis. Due to the different
A well-studied mitigation approach from the domain of scenario, many of the countermeasures typically suggested for
network-based cache fingerprinting involves creating spurious cache-based attack are no longer effective. Techniques such as
network activity to mask the actual website traffic [25]. It is constant-time programming [6] are only applicable to regular
possible to adapt this technique to our domain and create ac- code, typically found in implementations of cryptographic
tivity in the cache to mask the website rendering activity. Our primitives. It is hard to see how such techniques can be applied
initial experiments show some promise, but further research is to web browsers. Similarly, as we show, timer-based defenses
needed to assess its effectiveness and its effect on performance that reduce the timer frequency or add jitter are not effective.
and on power consumption. Cache randomization techniques [66, 80, 106] dissociate
Masking implementation. Our countermeasure repeatedly victim and adversary cache sets, and prevent the adversary
evicts the entire last-level cache. More specifically, we al- from monitoring victim access to specific addresses. However,
locate a cache-sized buffer and access every cache line in our attack measures the overall cache activity rather than
the buffer in a loop. Such masking could be applied in the looking at specific victim accesses. As such, such techniques
browser, in the operating system, as a browser plugin, and are unlikely to be effective against our attack.
even incorporated into a security-conscious website in the Cache partitioning, either using dedicated hardware [24,
form of JavaScript delivered to the client. For our initial proof 106] or via page coloring [63], is a promising approach for
of concept implementation we use a native code application, mitigating cache attacks. In a nutshell, the approach parti-
based on Mastik [111]. This setting allows us to investigate the tions the cache between security domains, preventing cross-
effectiveness of our countermeasure while leaving deployment domain contention. Web pages are often rendered within the
complexities for future work. same browser process. A page-coloring countermeasure will,
Evaluation. For evaluation, we use a computer featuring an therefore, need to adapt to the browser scenario. Alternatively,
Intel Core i5-2500, running Centos Linux version 7.6.1810. the current shift to strict site isolation [95] as part of the
We enable the countermeasure, then collect website traces both mitigations for Spectre [54], may assist in applying page
for Firefox (Linux) and for the Tor Browser, using the same coloring to protect against our attack. A further limitation of
mix of traces described in Section IV-B—100 traces of each of page coloring is that caches support only a handful of colors.
100 websites for the closed-world scenario and one additional Hence, colors need to be shared, particularly when a large
trace of each of 5,000 websites for the open-world scenario. number of tabs are open. To provide protection, page coloring
As in Section V-B, we use 10-fold cross validation for building will have to be augmented with a solution that prevents
and evaluating the models. concurrent use of the same color by multiple sites.
We find that the countermeasure completely thwarts the C ACHE BAR [113] limits the contention caused by each
attack when training is done on an unprotected system—the process as a protection for the Prime+Probe attack. Like cache

14
1545-5971 (c) 2020 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See [Link] for more information.
Authorized licensed use limited to: University of Durham. Downloaded on June 22,2020 at 03:40:18 UTC from IEEE Xplore. Restrictions apply.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TDSC.2020.2988369, IEEE
Transactions on Dependable and Secure Computing

20%

15%
Slowdown

10%

5%

0%
pe

bz

gc

go

hm k

sj r

lib

h2 ntu

om ef

as tpp

xa

IN cbm

bw

ga es

m ss

ze

gr p

ca cs

le AD

na d

de

so

po x

ca y

G ix

to FD

lb

sp

FP x3
en

rf
sl

em

m
cf

ilc

nt
om
qu

T
ip

ta

la

us

ct

pl

lc

hi
rlb

bm

64 m

al

vr
av
m

ne

ie M

o TD
ul
2

us

n
r

II
e

a
a

s
en

3
ch

k
Figure 11: Performance slowdown of our countermeasure on the SPEC benchmark. Error bars indicate one standard deviation.
INT and FP show the geometric mean of the SPEC integer and floating point benchmarks, respectively.

partitioning, this approach works at a process resolution and to capture this structure and therefore be less sensitive to
may require adaptions to work in the web browser scenario. concept drift. Another followup would be a design of drift-
Furthermore, unlike past cryptographic attacks that aim to resistant classifiers which can obtain good accuracy results
identify specific memory accesses, our technique measures with minimum maintenance over time.
the overall memory use of the victim. Consequently, unless
C ACHE BAR is configured to partition the cache, some cross- XI. AVAILABILITY
process contention will remain, allowing our attack to work.
To allow reproduction of our results, we published several
of the JavaScript datasets used in this work on the IEEE
X. L IMITATIONS AND F UTURE W ORK
DataPort website [89]. The linux_chrome,linux_ff59
Although we demonstrate the feasibility of cache-based and linux_tor are traces that collected on a Linux machine,
website fingerprinting and provide an analysis of the attack, we using the browsers Chrome, Firefox and Tor correspond-
do leave some areas for further study. Being the first analysis ingly. The directories win_chrome and win_ff59 are with
of its kind, the scope of the work does not match similar data collected on Windows 10, using the browsers Chrome
works on network-based website fingerprinting. In particular, and Firefox respectively. Finally, the directory mac_safari
our datasets are significantly smaller than those of Rimmer is data collected on MacOs with the Safari browser. The
et al. [83], for example. Providing larger datasets would allow experiment of the countermeasure is in a folder named
better analysis of the effectiveness of the technique. linux_tor_counter. These directories have subdirecto-
For most of our experiments we use identical machine con- ries CW and OW, for the closed-world and open-world sce-
figurations for collecting the training and test datasets. Some of narios. The closed-world files include up to 100 traces per
our results, in particular in sections VIII-B and VIII-C, show website, whereas the open-world files contain one trace per
the potential for using a single classifier that can effectively each website. All of the data files are in JSON format.
classify memorygrams collected on multiple configurations. The implementation of the JavaScript memorygram-
It would also be interesting to improve the accuracy of our mer is available online at ([Link]
cache size detection script, perhaps by training it under more GRRPzQm).
realistic conditions. Similarly, it would be interesting to see
whether the classifier can genuinely find commonalities be-
tween multiple browsers rendering the same website, or more XII. C ONCLUSIONS
generally whether a classifier can perform app classification In this work we investigate the use of cache side channels
and detect which browser is being used to browse to a for website fingerprinting. We implement two memorygram-
previously unknown website. mers, which capture the cache activity of the browser, and
This work further shares many of the limitations of network- show how to use deep learning to identify websites based on
based fingerprinting [51]. In particular, websites tend to change the cache activity that displaying them induces.
over time or based on the identity of the user or the specifica- We show that cache-based website fingerprinting achieves
tions of the computer used for displaying them. Furthermore, results comparable with the state-of-the-art network-based
our work, like most previous works, assumes that only one fingerprinting. We further show that cache-based fingerprinting
website is displayed at each time. Rimmer et al. [83] briefly outperforms network-based fingerprinting when the browser
discuss temporal aspects of website fingerprinting and our caches objects. Finally, we demonstrate that cache-based fin-
work further investigates concept drift over a 20 week period. gerprinting is resilient to both traffic molding and to re-
A followup to our results would be a direct comparison duced timer resolution. The former being the standard defense
between the concept drift of network-based fingerprinting for network-based website fingerprinting and the latter the
and cache-based fingerprinting. We believe that while the currently implemented countermeasure for mobile-code-based
content elements of a website, such as images and text, may micro-architectural attacks. To the best of our knowledge, this
change quickly, the general structure of a website changes is the first cache-based side-channel attack that works with the
much slower. Hence, cache-based traces may be better able 100 ms clock rate of the Tor Browser.

15
1545-5971 (c) 2020 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See [Link] for more information.
Authorized licensed use limited to: University of Durham. Downloaded on June 22,2020 at 03:40:18 UTC from IEEE Xplore. Restrictions apply.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TDSC.2020.2988369, IEEE
Transactions on Dependable and Secure Computing

We carried out a real-world evaluation of our attack on a [20] D. Cock, Q. Ge, T. C. Murray, and G. Heiser, “The last mile: An
set of computers with diverse hardware and software configu- empirical study of timing channels on seL4,” in CCS, 2014.
[21] W. Dai, “PipeNet description,” Post to the cypherpunks mailing list.
rations. Our results show that, while the accuracy of the attack [Link] 1998.
is severely degraded when the precise hardware and software [22] T. Dierks and E. Rescola, “The transport layer security (TLS) protocol
configuration of the victim is not known beforehand, it is still version 1.2,” Internet Requests for Comments, RFC 5246, 2008.
[23] R. Dingledine, N. Mathewson, and P. F. Syverson, “Tor: The second-
significantly higher than the base rate accuracy of a random generation onion router,” in USENIX Sec, 2004.
guess. Surprisingly, mispredicting the LLC cache size of the [24] L. Domnitser, A. Jaleel, J. Loew, N. B. Abu-Ghazaleh, and D. Pono-
victim’s computer had only a minor impact on the accuracy of marev, “Non-monopolizable caches: Low-complexity mitigation of
cache side channel attacks,” TACO, vol. 8, no. 4, pp. 35:1–35:21, 2012.
the website fingerprinting attack, as long as the training and [25] K. P. Dyer, S. E. Coull, T. Ristenpart, and T. Shrimpton, “Peek-a-Boo,
testing steps were carried out under the same assumption. I still see you: Why efficient traffic analysis countermeasures fail,” in
IEEE SP, 2012.
[26] J. Elson and A. Cerpa, “Internet content adaptation protocol (icap),”
ACKNOWLEDGEMENTS Internet Requests for Comments, RFC Editor, RFC 3507, April 2003.
[27] D. Evtyushkin, D. V. Ponomarev, and N. B. Abu-Ghazaleh, “Jump over
We would like to thank Vera Rimmer for her helpful ASLR: attacking branch predictors to bypass ASLR,” in MICRO, 2016.
comments and insights. We would also like to thank Roger [28] R. Fielding, M. Nottingham, and J. Reschke, “Hypertext transfer
protocol (HTTP/1.1): Caching,” Internet Requests for Comments, RFC
Dingledine and our shepherd Rob Jansen for reviewing and Editor, RFC 7234, June 2014, [Link]
commenting on the final version of the conference paper. [29] P. Frigo, C. Giuffrida, H. Bos, and K. Razavi, “Grand pwning unit:
This research was supported by the ARC Centre of Ex- Accelerating microarchitectural attacks with the GPU,” in IEEE SP,
2018.
cellence for Mathematical & Statistical Frontiers, an ARC [30] C. P. Garcı́a, B. B. Brumley, and Y. Yarom, ““Make sure DSA signing
Discovery Early Career Researcher Award DE200101577, exponentiations really are constant-time”,” in CCS, 2016.
Intel Corporation, Israel Science Foundation grants 702/16 and [31] Q. Ge, Y. Yarom, D. Cock, and G. Heiser, “A survey of microarchitec-
tural timing attacks and countermeasures on contemporary hardware,”
703/16, NSF CNS-1409415, and NSF CNS-1704105. J. Cryptographic Engineering, vol. 8, no. 1, pp. 1–27, 2018.
[32] D. Genkin, L. Pachmanov, E. Tromer, and Y. Yarom, “Drive-by key-
R EFERENCES extraction cache attacks from portable code,” in ACNS, 2018.
[33] X. Gong, N. Borisov, N. Kiyavash, and N. Schear, “Website detection
[1] “Tcpreplay,” [Link] using remote traffic analysis,” in PET, 2012.
[2] K. Abe and S. Goto, “Fingerprinting attack on Tor anonymity using [34] I. Goodfellow, Y. Bengio, and A. Courville, Deep Learning (Adaptive
deep learning,” in APAN, 2016. Computation and Machine Learning series). The MIT Press, 2016.
[3] O. Acıiçmez, “Yet another microarchitectural attack: : exploiting I- [35] B. Gras, K. Razavi, E. Bosman, H. Bos, and C. Giuffrida, “ASLR on
Cache,” in CSAW, 2007. the line: Practical cache attacks on the MMU,” in NDSS, 2017.
[4] O. Acıiçmez, B. B. Brumley, and P. Grabher, “New results on instruc- [36] D. Gruss, R. Spreitzer, and S. Mangard, “Cache template attacks:
tion cache attacks,” in CHES, 2010. Automating attacks on inclusive last-level caches,” in USENIX Sec,
[5] K. Al-Naami, A. El Ghamry, M. S. Islam, L. Khan, B. M. Thuraising- 2015.
ham, K. W. Hamlen, M. Alrahmawy, and M. Rashad, “BiMorphing: A [37] D. Gruss, C. Maurice, A. Fogh, M. Lipp, and S. Mangard, “Prefetch
bi-directional bursting defense against website fingerprinting attacks,” side-channel attacks: Bypassing SMAP and kernel ASLR,” in CCS,
IEEE Transactions on Dependable and Secure Computing, 2019. 2016.
[6] D. J. Bernstein, T. Lange, and P. Schwabe, “The security impact of a [38] B. Gülmezoglu, A. Zankl, T. Eisenbarth, and B. Sunar, “PerfWeb: How
new cryptographic library,” in LATINCRYPT, 2012. to violate web privacy with hardware performance events,” in ESORICS
[7] S. Bhat, D. Lu, A. Kwon, and S. Devadas, “Var-CNN: A data-efficient (2), 2017.
website fingerprinting attack based on deep learning,” PoPETs, vol. [39] J. Hayes and G. Danezis, “k-fingerprinting: A robust scalable website
2019, no. 4, pp. 292–310, 2019. fingerprinting technique,” in USENIX Sec, 2016.
[8] S. Bhattacharya and D. Mukhopadhyay, “Who watches the watchmen?: [40] K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image
Utilizing performance monitors for compromising keys of RSA on Intel recognition,” in CVPR, 2016.
platforms,” in CHES, 2015. [41] D. Herrmann, R. Wendolsky, and H. Federrath, “Website fingerprinting:
[9] Z. Bloom, “Cloud computing without containers,” [Link] attacking popular privacy enhancing technologies with the multinomial
[Link]/cloud-computing-without-containers/, 2018. naı̈ve-bayes classifier,” in CCSW, 2009.
[10] J. M. Booth, “Not so incognito: Exploiting resource-based side chan- [42] A. Hintz, “Fingerprinting websites using traffic analysis,” in Privacy
nels in JavaScript engines,” Bachelor Thesis, Harvard, April 2015. Enhancing Technologies, 2002.
[11] F. Brasser, U. Müller, A. Dmitrienko, K. Kostiainen, S. Capkun, [43] S. Hochreiter and J. Schmidhuber, “Long short-term memory,” Neural
and A. Sadeghi, “Software grand exposure: SGX cache attacks are Computation, vol. 9, no. 8, pp. 1735–1780, 1997.
practical,” in WOOT, 2017. [44] W. Hu, “Lattice scheduling and covert channels,” in IEEE SP, 1992.
[12] X. Cai, X. C. Zhang, B. Joshi, and R. Johnson, “Touching from a [45] M. S. Inci, B. Gülmezoglu, G. Irazoqui, T. Eisenbarth, and B. Sunar,
distance: website fingerprinting attacks and defenses,” in CCS, 2012. “Cache attacks enable bulk key recovery on the cloud,” in CHES, 2016.
[13] X. Cai, R. Nithyanand, and R. Johnson, “Cs-buflo: A congestion [46] Intel Corp., “Intel 64 and IA-32 architectures software developer’s
sensitive website fingerprinting defense,” in WPES, 2014. manual volume 3B,” Sep. 2016. [Online]. Available: [Link]
[14] X. Cai, R. Nithyanand, T. Wang, R. Johnson, and I. Goldberg, “A sys- [Link]/content/dam/www/public/us/en/documents/manuals/64-ia-
tematic approach to developing and evaluating website fingerprinting [Link]
defenses,” in CCS, 2014. [47] ——, “Intel 64 and IA-32 architectures optimization refer-
[15] A. Caliskan-Islam, R. Harang, A. Liu, A. Narayanan, C. Voss, F. Ya- ence manual,” [Link]
maguchi, and R. Greenstadt, “De-anonymizing programmers via code and-technology/[Link], Jun.
stylometry,” in USENIX Sec, 2015. 2016.
[16] T. Chen and C. Guestrin, “XGBoost: A scalable tree boosting system,” [48] G. Irazoqui Apecechea, T. Eisenbarth, and B. Sunar, “S$A: A shared
in KDD, 2016. cache attack that works across cores and defies VM sandboxing - and
[17] H. Cheng and R. Avnur, “Traffic analysis of SSL encrypted web its application to AES,” in IEEE SP, 2015.
browsing,” Project paper, University of Berkeley, 1998. [49] S. Jana and V. Shmatikov, “Memento: Learning secrets from process
[18] G. Cherubin, J. Hayes, and M. Juárez, “Website fingerprinting defenses footprints,” in IEEE SP, 2012.
at the application layer,” PoPETs, vol. 2017, no. 2, pp. 186–203, 2017. [50] R. Jansen, M. Juárez, R. Galvez, T. Elahi, and C. Dı́az, “Inside job:
[19] S. S. Clark, H. A. Mustafa, B. Ransford, J. Sorber, K. Fu, and W. Xu, Applying traffic analysis to measure Tor from within,” in NDSS, 2018.
“Current events: Identifying webpages by tapping the electrical outlet,” [51] M. Juárez, S. Afroz, G. Acar, C. Dı́az, and R. Greenstadt, “A critical
in ESORICS, 2013. evaluation of website fingerprinting attacks,” in CCS, 2014.

16
1545-5971 (c) 2020 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See [Link] for more information.
Authorized licensed use limited to: University of Durham. Downloaded on June 22,2020 at 03:40:18 UTC from IEEE Xplore. Restrictions apply.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TDSC.2020.2988369, IEEE
Transactions on Dependable and Secure Computing

[52] M. Juárez, M. Imani, M. Perry, C. Dı́az, and M. Wright, “Toward an [81] M. K. Reiter and A. D. Rubin, “Crowds: Anonymity for web transac-
efficient website fingerprinting defense,” in ESORICS (1), 2016. tions,” ACM Trans. Inf. Syst. Secur., vol. 1, no. 1, pp. 66–92, 1998.
[53] H. Kim, S. Lee, and J. Kim, “Inferring browser activity and status [82] E. Rescola, “HTTP over TLS,” Internet Requests for Comments, RFC
through remote monitoring of storage usage,” in ACSAC, 2016. Editor, RFC 2818, 2000, [Link]
[54] P. Kocher, J. Horn, A. Fogh, D. Genkin, D. Gruss, W. Haas, M. Haburg, [83] V. Rimmer, D. Preuveneers, M. Juarez, T. Van Goethem, and W. Joosen,
M. Lipp, S. Mangard, T. Prescher, M. Schwartz, and Y. Yarom, “Spectre “Automated website fingerprinting through deep learning,” in NDSS,
attacks: Exploiting speculative execution,” in IEEE SP, May 2019. 2018.
[55] D. Kohlbrenner and H. Shacham, “Trusted browsers for uncertain [84] T. Ristenpart, E. Tromer, H. Shacham, and S. Savage, “Hey, you, get
times,” in USENIX Sec, 2016. off of my cloud: exploring information leakage in third-party compute
[56] N. Köskal, “‘Terrifying’: How a single line of computer code put clouds,” in CCS, 2009.
thousands of innocent Turks in jail,” [Link] [85] J. Rutkowska and R. Wojtczuk, “Qubes OS architecture,”
terrifying-how-a-single-line-of-computer-code-put-thousands-of- [Link]
innocent-turks-in-jail-1.4495021, Jan. 2018. [Link], Feb. 2010.
[57] A. Krogh, M. Brown, I. S. Mian, K. Sjolander, and D. Haussler, [86] M. Schwarz, C. Maurice, D. Gruss, and S. Mangard, “Fantastic timers
“Hidden Markov models in computational biology. Applications to and where to find them: High-resolution microarchitectural attacks in
protein modeling,” Journal of Molecular Biology, vol. 235, no. 5, pp. JavaScript,” in Financial Cryptography, 2017.
1501–1531, 1994. [87] M. Schwarz, M. Lipp, and D. Gruss, “JavaScript zero: Real JavaScript
[58] S. Lee, Y. Kim, J. Kim, and J. Kim, “Stealing webpages rendered on and zero side-channel attacks,” in NDSS, 2018.
your browser by exploiting GPU vulnerabilities,” in IEEE SP, 2014. [88] A. Shusterman, L. Kang, Y. Haskal, Y. Meltser, P. Mittal, Y. Oren, and
[59] S. Lee, M. Shih, P. Gera, T. Kim, H. Kim, and M. Peinado, “Inferring Y. Yarom, “Robust website fingerprinting through the cache occupancy
fine-grained control flow inside SGX enclaves with branch shadowing,” channel,” in USENIX Sec, 2019.
in USENIX Sec, 2017. [89] A. Shusterman, L. Kang, Y. Haskal, Y. Meltzer, P. Mittal, Y. Oren, and
[60] F. Li, R. Fergus, and P. Perona, “One-shot learning of object cate- Y. Yarom, “Website fingerprinting - last level cache contention traces,”
gories,” IEEE Trans. Pattern Anal. Mach. Intell., vol. 28, no. 4, pp. 2019. [Online]. Available: [Link]
594–611, 2006. [90] P. Sirinam, M. Imani, M. Juárez, and M. Wright, “Deep fingerprinting:
[61] S. Li, H. Guo, and N. Hopper, “Measuring information leakage in Undermining website fingerprinting defenses with deep learning,” in
website fingerprinting attacks and defenses,” in CCS, 2018. CCS, 2018.
[62] B. Liang, W. You, L. Liu, W. Shi, and M. Heiderich, “Scriptless timing [91] P. Sirinam, N. Mathews, M. S. Rahman, and M. Wright, “Triplet
attacks on web browser privacy,” in DSN, 2014. fingerprinting: More practical and portable website fingerprinting with
[63] J. Liedtke, H. Härtig, and M. Hohmuth, “OS-controlled cache pre- n-shot learning,” in CCS, 2019.
dictability for real-time systems,” in IEEE RTAS, 1997. [92] Spiegel Online, “Documents reveal top NSA hacking unit,”
[64] P. Lifshits, R. Forte, Y. Hoshen, M. Halpern, M. Philipose, M. Tiwari, [Link]
and M. Silberstein, “Power to peep-all: Inference attacks by malicious [Link], Dec.
batteries on mobile devices,” PoPETs, vol. 2018, no. 4, pp. 1–1, 2018. 2013.
[93] C. D. Spradling, “SPEC CPU2006 benchmark tools,” SIGARCH Com-
[65] M. Lipp, M. Schwartz, D. Gruss, T. Prescher, W. Haas, A. Fogh,
puter Architecture News, vol. 35, no. 1, pp. 130–134, 2007.
J. Horn, S. Mangard, P. Kocher, D. Genkin, Y. Yarom, and M. Hamburg,
[94] R. Spreitzer, S. Griesmayr, T. Korak, and S. Mangard, “Exploiting
“Meltdown: Reading kernel memory from user space,” in USENIX Sec,
data-usage statistics for website fingerprinting attacks on Android,” in
Aug. 2018.
WISEC, 2016.
[66] F. Liu and R. B. Lee, “Random fill cache architecture,” in MICRO,
[95] The Chromium Project, “Site isolation,” [Link]
2014.
Home/chromium-security/site-isolation.
[67] F. Liu, Y. Yarom, Q. Ge, G. Heiser, and R. B. Lee, “Last-level cache
[96] The Squid Software Foundation, “The Squid Proxy,” [Link]
side-channel attacks are practical,” in IEEE SP, 2015.
[Link].
[68] X. Liu, J. Wu, and Z. Zhou, “Exploratory undersampling for class- [97] The Tor Project, Inc., “The Tor Browser,” [Link]
imbalance learning,” IEEE Trans. Systems, Man, and Cybernetics, Part projects/[Link].
B, vol. 39, no. 2, pp. 539–550, 2009. [98] Y. Tsunoo, T. Saito, T. Suzaki, M. Shigeri, and H. Miyauchi, “Crypt-
[69] L. Lu, E. Chang, and M. C. Chan, “Website fingerprinting and analysis of DES implemented on computers with cache,” in CHES,
identification using ordered feature sequences,” in ESORICS, 2010. 2003.
[70] N. Matyunin, Y. Wang, T. Arul, J. Szefer, and S. Katzenbeisser, [99] L. Uhsadel, A. Georges, and I. Verbauwhede, “Exploiting hardware
“MagneticSpy: Exploiting magnetometer in mobile devices for website performance counters,” in FDTC, 2008.
and application fingerprinting,” arXiv:1906.11117, 2019. [100] K. Varda, [Link] 2018.
[71] Mozilla Foundation, “Security advisory 2018-01,” [Link] [101] P. Vila and B. Köpf, “Loophole: Timing attacks on shared event loops
org/en-US/security/advisories/mfsa2018-01/, 2018. in Chrome,” in USENIX Sec, 2017.
[72] A. Narayanan, H. Paskov, N. Z. Gong, J. Bethencourt, E. Stefanov, [102] L. Wagner, “Mitigations landing for new class of timing attack,”
E. C. R. Shin, and D. Song, “On the feasibility of internet-scale author [Link]
identification,” in IEEE SP, 2012. class-timing-attack/, Jan. 2018.
[73] R. Nithyanand, X. Cai, and R. Johnson, “Glove: A bespoke website [103] T. Wang and I. Goldberg, “Improved website fingerprinting on Tor,”
fingerprinting defense,” in WPES, 2014. in WPES, 2013.
[74] Y. Oren, V. P. Kemerlis, S. Sethumadhavan, and A. D. Keromytis, [104] ——, “On realistically attacking Tor with website fingerprinting,”
“The spy in the sandbox: Practical cache attacks in JavaScript and PoPETs, vol. 2016, no. 4, pp. 21–36, 2016.
their implications,” in CCS, 2015. [105] ——, “Walkie-Talkie: An efficient defense against passive website
[75] D. A. Osvik, A. Shamir, and E. Tromer, “Cache attacks and counter- fingerprinting attacks,” in USENIX Sec, 2017.
measures: The case of AES,” in CT-RSA, 2006. [106] Z. Wang and R. B. Lee, “New cache designs for thwarting software
[76] A. Panchenko, L. Niessen, A. Zinnen, and T. Engel, “Website finger- cache-based side channel attacks,” in ISCA, 2007.
printing in onion routing based anonymization networks,” in WPES, [107] Z. Weinberg, E. Y. Chen, P. R. Jayaraman, and C. Jackson, “I still
2011. know what you visited last summer: Leaking browsing history via user
[77] A. Panchenko, F. Lanze, J. Pennekamp, T. Engel, A. Zinnen, M. Henze, interaction and side channel attacks,” in IEEE SP, 2011.
and K. Wehrle, “Website fingerprinting at internet scale,” in NDSS, [108] Y. Xu, T. Wang, Q. Li, Q. Gong, Y. Chen, and Y. Jiang, “A multi-tab
2016. website fingerprinting attack,” in ACSAC, 2018.
[78] C. Percival, “Cache missing for fun and profit,” 2005, presented [109] J. Yan and J. Kaur, “Feature selection for website fingerprinting,”
at BSDCan. [Link] PoPETs, vol. 2018, no. 4, pp. 200–219, 2018.
harmful. [110] Q. Yang, P. Gasti, G. Zhou, A. Farajidavar, and K. S. Balagani, “On
[79] F. Pizlo, “What Spectre and Meltdown mean for WebKit,” https: inferring browsing activity on smartphones via USB power analysis
//[Link]/blog/8048/what-spectre-and-meltdown-mean-for-webkit/, side-channel,” IEEE Trans. Information Forensics and Security, vol. 12,
Jan. 2018. no. 5, pp. 1056–1066, 2017.
[80] M. K. Qureshi, “CEASER: Mitigating conflict-based cache attacks via [111] Y. Yarom, “Mastik: A micro-architectural side-channel toolkit,” http:
encrypted-address and remapping,” in MICRO, 2018. //[Link]/∼yval/Mastik/[Link], Sep. 2016.

17
1545-5971 (c) 2020 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See [Link] for more information.
Authorized licensed use limited to: University of Durham. Downloaded on June 22,2020 at 03:40:18 UTC from IEEE Xplore. Restrictions apply.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TDSC.2020.2988369, IEEE
Transactions on Dependable and Secure Computing

[112] Y. Yarom and N. Benger, “Recovering OpenSSL ECDSA nonces Dvir Levi is an undergraduate student in the De-
using the F LUSH +R ELOAD cache side-channel attack,” Cryptology partment of Software and Information Systems En-
ePrint Archive, Report 2014/140, 2014. [Online]. Available: http: gineering in Ben-Gurion University of the Negev,
//[Link]/2014/140 Israel.
[113] Z. Zhou, M. K. Reiter, and Y. Zhang, “A software approach to defeating
side channels in last-level caches,” in CCS, 2016.
[114] Z. Zhuo, Y. Zhang, Z. Zhang, X. Zhang, and J. Zhang, “Website
fingerprinting attack on anonymity networks based on profile hidden
markov model,” IEEE Trans. Information Forensics and Security,
vol. 13, no. 5, pp. 1081–1095, 2018.

Anatoly Shusterman is a Ph.D student in the Yosef Meltser is an undergraduate student in the
Department of Software and Information Systems Department of Software and Information Systems
Engineering in Ben-Gurion University of the Negev, Engineering in Ben-Gurion University of the Negev,
Israel. Israel.

Zohar Avraham is an undergraduate student in the Prateek Mittal (SM’ 17) is an Associate Profes-
Department of Software and Information Systems sor in the Department of Electrical Engineering at
Engineering in Ben-Gurion University of the Negev, Princeton University. He obtained his Ph.D. from
Israel. the University of Illinois at Urbana-Champaign in
2012. He is the recipient of the NSF CAREER
award (2016), ONR YIP award (2018), M.E. Van
Valkenburg award, Google Faculty Research Award
(2016, 2017), Cisco Faculty research award (2016),
Intel Faculty research award (2016, 2017), and IBM
Faculty award (2017). He was awarded Princeton
University’s E. Lawrence Keyes Award for outstand-
ing research and teaching, and is the recipient of multiple outstanding paper
awards including ACM CCS and ACM ASIACCS.

Eliezer Croitoru is a Linux System Engineer at Internet Rimon and a

contributor to the Squid-Cache and ICAP open-source projects.

Yossi Oren (SM’ 17) received his [Link]. degree in

Computer Science from the Weizmann Institute of
Science, Israel, and his Ph.D. degree in Electrical
Engineering from Tel Aviv University, Israel, in
Yarden Haskal is an undergraduate student in the 2008 and 2013 respectively. He is a Senior Lec-
Department of Software and Information Systems turer (Assistant Professor) with the Department of
Engineering in Ben-Gurion University of the Negev, Software and Information Systems Engineering in
Israel. Ben-Gurion University, Israel. His research interests
include implementation security (power analysis and
other hardware attacks and countermeasures; low-
resource cryptographic constructions for lightweight
computers) and cryptography in the real world (consumer and voter privacy
in the digital era; web application security).

Yuval Yarom (M’16) is a senior lecturer in com-

Lachlan Kang Lachlan Kang is a network secu- puter science at the University of Adelaide, where
rity and internet privacy expert who has spent his he heads the security domain in the Centre for Dis-
research career trying to improve online anonymity tributed and Intelligent Technologies. His research
by finding flaws in existing systems and patching focuses on the security implications of the discrep-
them. His current research interests include offensive ancy between the nominal and the true behaviour
network and internet security. of processors, with a focus on side channel and
speculative execution attacks. He is the recipient
of the 2020 Chris Wallace Award for Outstanding
Research and is a DECRA Fellow.

18
1545-5971 (c) 2020 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See [Link] for more information.
Authorized licensed use limited to: University of Durham. Downloaded on June 22,2020 at 03:40:18 UTC from IEEE Xplore. Restrictions apply.