On the Resilience of Traffic Features under Concept Drift in Hidden Service Fingerprinting

Website Fingerprinting (WF) has emerged as a promising technique for identifying user access patterns to Hidden Services (HS). Despite growing interest in WF for HS, the absence of well-established foundations and systematic guidelines for feature selection undercuts the robustness of WF techniques in the face of concept drift. To address this gap, we present an empirical study focusing on feature resilience under concept drift in WF for HS. Specifically, we categorize features into network-specific and network-agnostic groups and quantify their information leakage potential via mutual information. We further assess each feature’s resilience to concept drift by evaluating its distributional stability through Kullback-Leibler (KL) divergence. To support our analysis, we construct a dedicated dataset capturing HS traffic across multiple time windows. Our evaluation reveals that although often overlooked by existing studies, network-specific features—especially time-based ones—not only leak more identifiable information but also exhibit greater stability against distributional shifts over time. We further investigate the underlying root causes of this phenomenon, offering insights that expand the theoretical underpinnings of WF and guide future feature selection strategies.