RoFiRe: Robust Website Fingerprinting on Real-World Tor Traffic via Improved Augmentation and Normalization

Website Fingerprinting (WF) attacks infer visited websites from encrypted traffic patterns, threatening the anonymity of Tor users. While deep learning has improved WF accuracy on synthetic datasets, its effectiveness on real Tor traffic remains unclear. We present RoFiRe, a novel WF model explicitly designed for real Tor exit traffic. It employs dynamic window-level augmentation and RMS-based pre-normalization tailored to irregular burst patterns and variable-length traces observed in the realistic GTT23 dataset, improving data efficiency and robustness. Across standard WF, concept-drift, and real-world open-world evaluations on GTT23, RoFiRe consistently outperforms state-of-the-art baselines by up to 9%. This study presents the first comprehensive analysis of WF on real Tor traffic, showing that WF models incorporating augmentation remain effective under realistic, data-limited conditions and can pose significant privacy risks.