## 2 Related Work
### WFP Defenses  
Currently, techniques designed to change traffic patterns before and after the network pipeline are mainly used to defend against WFP [28; 29; 30; 31]. This reduces the accuracy of the WFP classification to a safe range. [PERSON] and [PERSON] et al. [32] designed an adaptive padding (AP) defense early on, where the AP decides whether to pad based on the arrival of the next packet with a specified interval range. [PERSON] et al. (2018) made the packet sequence look like it came from another webpage by random padding, thus achieving traffic obfuscation. It is now only valid for identification methods that rely on unique packet lengths, not for those that rely on other elements ([PERSON] et al., 2016; [PERSON] et al., 2018; [PERSON] et al., 2018). The BuFlo defense (buffered fixed-length obfuscation), proposed by [PERSON] et al. (2018), required additional auxiliary server support. At the same time, the defense modes such as packet padding, artificial delays, and circuit padding are concentrated, resulting in a very large network overhead. [PERSON] et al. (2018) proposed a CS-BuFLO defense to improve it by introducing a rate adaptation mechanism to solve the problem that BuFLO cannot adapt to different network connections.  
[PERSON] et al. (2018) proposed WTF-PAD (fingerprinting protection with adaptive defense), a mechanism based on the AP defense. Compared to the previous AP defense, WTF-PAD adds a state machine. How this works is that once the server's message delivery time is reported to the client, the client will trigger the padding to further obfuscate traffic patterns. Secondly, after the client sends a request, WTF-PAD will evoke the server to padding to obfuscate website fingerprinting. However, this approach was later defeated by deep learning classifiers, so [PERSON] et al. (2018) proposed DFD (deep fingerprinting defender) to improve WTF-PAD by designing two modules, injection monitoring and injection buffering, which are used to record the last burst length and project the current number of injected packets. [PERSON] et al. (2016) proposed an adversarial sample-based defense, which deliberately adds subtle imperceptible perturbations to the samples, causing the model to output incorrectly. To generate perturbed samples in real time, [PERSON] et al. (2018) proposed the blind adversarial network perturbations (BANP) defense. This defense makes perturbation generation independent of the target input by solving a specific optimization problem. However, the performance of this approach for the BANP defense degrades dramatically under the adversarial training model. This team proposed another blind adversarial perturbation defense against WFP in 2021 by introducing a remapping function to ensure no interference with the original traffic patterns. This adversarial sample idea needs to consider overhead and defense performance, in addition to real-time performance and the ability to resist adversarial training.  
There is a traffic-splitting defense technique ([PERSON] et al., 2018; [PERSON] et al., 2018) that ensures less overhead in the defense process. [PERSON] et al. (2018) designed TrafficSliver according to the traffic splitting technique, which intercepts client traffic and distributes it to multiple Tor subcircuits for delivery by deploying a proxy between the client and entry ORs. This method achieves better security goals using less overhead. However, TrafficSliver must receive all dispersed subcircuit packets in order to aggregate them. If the data from one of the subcircuits arrives late, the next packet must wait until it arrives in order. If a packet of one path is lost, the original content cannot be restored. The defense SMART proposed in this paper solves this problem well, aiming at deployability and high feasibility, and significantly reduces the accuracy of state-of-the-art WFP attacks with low overhead.