## 2 Related Work  
### WFP Attacks  
In research revealing the privacy of user communication relationships, communication traffic feature engineering has been a critical concern for researchers. In the early days of HTTP 1.0, every time a web resource (image, script, etc.) was loaded, a new TCP connection needed to be established with the server. This means that if an adversary wants to identify the overall length of each resource, they should have the ability to differentiate between different TCP connections. This is how the earliest attacks were carried out. The studies by [PERSON] et al. 2002 [14], [PERSON] 2003 [15], and [PERSON] et al. 1998 [16] demonstrated how analyzing traffic length could contribute to page identification. However, later versionsof HTTP 1.1 support long connections by default. When loading an HTML file, multiple requests and responses in the file can be transmitted over the same TCP connection, so it is not easy to have privacy compromised by resource length. In 2006, [PERSON] and [PERSON] [17] showed that unique packet length is a powerful WFP feature and built two traffic identification systems. One is based on a Naive Bayes classifier, while the other is on Jaccard coefficients. Both schemes depend on packet length. The authors used the Jaccard coefficient to calculate the distance between two streams and assumed that the probability of the occurrence of various stream lengths in Naive Bayes is independent of each other. Subsequently, [PERSON] et al. [18] improved this approach by combining text detection techniques. In 2011, for the first time, [PERSON] et al. [19] performed a WFP attack against Tor in an open-world scenario, defining a new set of characteristics using the packet count, packet interval, and direction, increasing WFP accuracy from 3% to 55% with a support vector machine (SVM) classifier. As a result, this work inspired a large amount of later work in the field of WFP. In the same year, [PERSON] et al. [20] used the edit distance to calculate the gap between the traffic streams, and they significantly improved attack accuracy by modifying the SVM kernel. In 2013, [PERSON] and [PERSON] et al. [21] proposed improvements to [PERSON] et al. 's system based on the further observed page loading approach and OSAD, an algorithm that modifies the edit distance. [PERSON] et al. 2014 [12] demonstrated a new k-nearest neighbor (k-NN) WFP classifier model, which uses monitored website fingerprinting to train feature weights, and the input data set in the classification stage also includes unmonitored website traces. The condition for a page to be classified into a certain class is that all the k neighbors are regarded as the same class. In the same year, [PERSON] et al. [22] criticized some unrealistic assumptions made in previous work, and [PERSON] and [PERSON] [3] revisited some of the conditions for WFP to execute successfully and showed the way for attackers to obtain the latest training data. Current WF research efforts are trying to continuously optimize evaluation methods: avoiding the use of sale data, using large-scale datasets generated in realistic scenarios, increasing the size of the monitoring site set, etc. The most advanced machine learning methods are applied to WFP to improve accuracy [5; 6; 7]. In 2016, [PERSON] et al. [8] collected the most representative and comprehensive dataset at that time in order to explore the practical limitations of WFP in the context of the Internet. They proposed a new classifier called CUMUL that performs better in terms of computational complexity and classification accuracy than previous approaches. As another contemporaneous WFP classifier, Random decision forests are used to carry out attacks via k-fingerprinting [9].