Selfish mining, one of the most renowned attack in Bitcoin, involves a selfish miner withholding discovered blocks and broadcasting them at an opportune moment to gain higher rewards than honest mining. However, selfish mining and its variants rely on two assumptions: the attacker solely engages in infiltration mining within the victim pool (attack assumption) and the system operates in a perfect network environment (network assumption). In this paper, we propose a novel attack called Selfish in Innocent Mining (SIM). SIM expands the range of attacker’s behaviors by incorporating selfish mining into the traditional framework of innocent and infiltration mining, without increasing the attacker’s computational power. Initially, we analyze all possible states of chains in the system and their transition probabilities in the context of the SIM attack using Markov Chain. We determine the attacker’s rewards in one victim pool, multiple victim pools, and the miner’s dilemma within different cases. Subsequently, we examine the impact of an imperfect network environment on the attacker’s rewards within the SIM framework, focusing on the influence of unintentional fork rates on rewards. Our quantitative analysis demonstrates that the attacker’s rewards in SIM exceed those in power-adjusting withholding (PAW) by$1.9\times $and$2.7\times $in different network environments, respectively. The attacker’s rewards threshold reduced to 12.38% compared to other benchmarks.

While the anonymous communication system Tor can protect user privacy, website fingerprinting (WF) attackers can still identify the websites that users access over encrypted network connections by analyzing the metadata generated during network communication. Despite the emergence of new WF attack techniques in recent years, most research in this area has focused on pure traffic traces generated from single-tab browsing behavior. However, multi-tab browsing behavior significantly degrades the performance of WF classification models based on the single-tab assumption. As a result, some research has shifted its focus to multi-tab WF attacks, although most of these works have limited utilization of the mixed information contained in multi-tab traces. In this paper, we propose an end-to-end multi-tab WF attack model, called Transformer-based model for Multi-tab Website Fingerprinting attack (TMWF). Inspired by object detection algorithms in computer vision, we treat multi-tab WF recognition as a problem of predicting ordered sets with a maximum length. By adding enough single-tab queries to the detection model and letting each query extract WF features from different positions in the multi-tab traces, our model's Transformer architecture capitalizes more fully on trace features. Paired with our new proposed model training approach, we accomplish adaptive recognition of multi-tab traces with varying numbers of web pages. This approach successfully eliminates a strong and unrealistic assumption in the field of multi-tab WF attacks - that the number of tabs contained in a sample belongs to the attacker's prior knowledge. Experimental results in various scenarios demonstrate that the performance of TMWF is significantly better than existing multi-tab WF attack models. To evaluate model performance in more authentic scenarios, we present a dataset of multi-tab trace data collected from real open-world environments.