# I Know Why You Went to the Clinic: Risks and Realization of HTTPS Traffic Analysis

arXiv: https://arxiv.org/abs/1403.0297 · HTML: https://mlsanity.com/paper/1403.0297/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 3 Mar 2014.

## Built on by (most cited first, 1 of 1)

- [FlowletFormer: Network Behavioral Semantic Aware Pre-training Model for Traffic Classification](https://mlsanity.com/paper/2508.19924/) (2025)

## Abstract (arXiv)

Revelations of large scale electronic surveillance and data mining by governments and corporations have fueled increased adoption of HTTPS. We present a traffic analysis attack against over 6000 webpages spanning the HTTPS deployments of 10 widely used, industry-leading websites in areas such as healthcare, finance, legal services and streaming video. Our attack identifies individual pages in the same website with 89% accuracy, exposing personal details including medical conditions, financial and legal affairs and sexual orientation. We examine evaluation methodology and reveal accuracy variations as large as 18% caused by assumptions affecting caching and cookies. We present a novel defense reducing attack accuracy to 27% with a 9% traffic increase, and demonstrate significantly increased effectiveness of prior defenses in our evaluation context, inclusive of enabled caching, user-specific cookies and pages within the same website.