PerfWeb: How to Violate Web Privacy with Hardware Performance Events

Berk Gülmezoglu, Thomas Eisenbarth, Berk Sunar, Andreas Zankl


The browser history reveals highly sensitive information about users, such as financial status, health conditions, or political views. Private browsing modes and anonymity networks are consequently important tools to preserve the privacy not only of regular users but in particular of whistleblowers and dissidents. Yet, in this work we show how a malicious application can infer opened websites from Google Chrome in Incognito mode and from Tor Browser by exploiting hardware performance events (HPEs). In particular, we analyze the browsers’ microarchitectural footprint with the help of advanced Machine Learning techniques: k-th Nearest Neighbors, Decision Trees, Support Vector Machines, and in contrast to previous literature also Convolutional Neural Networks. We profile 40 different websites, 30 of the top Alexa sites and 10 whistleblowing portals, on two machines featuring an Intel and an ARM processor. By monitoring retired instructions, cache accesses, and bus cycles for at most 5 s we manage to classify the selected websites with a success rate of up to 86.3%. The results show that hardware performance events can clearly undermine the privacy of web users. We therefore propose mitigation strategies that impede our attacks and still allow legitimate use of HPEs.
Original languageEnglish
Title of host publicationComputer Security – ESORICS 2017
EditorsSimon N. Foley, Dieter Gollmann, Einar Snekkenes
Number of pages18
PublisherSpringer Verlag
Publication date12.08.2017
ISBN (Print)978-3-319-66398-2
ISBN (Electronic)978-3-319-66399-9
Publication statusPublished - 12.08.2017
Event22nd European Symposium on Research in Computer Security - Oslo, Norway
Duration: 11.09.201715.09.2017


Dive into the research topics of 'PerfWeb: How to Violate Web Privacy with Hardware Performance Events'. Together they form a unique fingerprint.

Cite this