Abstract:Tor is the most widely used anonymous communication system at present which can anonymize users' network behavior. At the same time, many illegal network activities also appear more frequently with the help of Tor, posing serious challenges for cyberspace security. Therefore, flow fingerprinting and flow correlation analysis methods are put forward to de-anonymize the malicious anonymous behaviors, which utilize external traffic features as the side-channel information. However, the adversary often reduces the ability of above two methods by adding the disturbance to the anonymous traffic. As a countermeasure against the interference, disturbance-resistant analysis methods can effectively identify those adversarial behaviors while knowing how the traffic is modified. However, in real scenarios, it is unrealistic to distinguish between disturbed and nondisturbed anonymous traffic, let alone to have a clear grasp of the disturbing strategy. In this paper, we propose a blind anonymous traffic analysis method called Blind Analyzer based on pattern reconstruction skills in a "masking-generation" manner. Specifically, Blind Analyzer extracts the pattern knowledge from non-disturbed traffic samples by masking and reconstructing them. During the method application, disturbed anonymous traces are processed following the same way, aiming at removing the incremental noise at the masking stage and restoring the original shape at the reconstruction stage. Besides, a conditional discriminator is designed to determine whether the generated sample has obvious class characteristics. Benefited from the proposed method, we can improve the effectiveness of the anonymous network behavior analysis since the disturbed traffic can be restored as normal ones accurately enough. Experiment results on three datasets show that reconstructed traffic samples output by Blind Analyzer are more useful for base analysis models, which improve the corresponding metric values by 11.23% and 6.61% in max for flow fingerprinting and correlation tasks, respectively.

A Hierarchical Classification Approach for Tor Anonymous Traffic

Traffic Classification of User Behaviors in Tor, I2P, ZeroNet, Freenet

Online Identification of Tor Anonymous Communication Traffic

Classifying Tor Traffic Encrypted Payload Using Machine Learning

RNN-LSTM Based Deep Learning Model for Tor Traffic Classification

A Novel Application Classification Attack Against Tor

Tor Anonymous Traffic Identification Based on Gravitational Clustering

Temporal Sequence of Data Fluctuation-Based Approach for Tor Program Classification

TorWard: Discovery of malicious traffic over Tor

Obfuscated Tor Traffic Identification Based on Sliding Window.

Network Traffic Classification Method Supporting Unknown Protocol Detection

Online Internet Traffic Identification Algorithm Based on Multistage Classifier

A Blind Flow Fingerprinting and Correlation Method Against Disturbed Anonymous Traffic Based on Pattern Reconstruction

Tree-RNN: Tree structural recurrent neural network for network traffic classification

TSCRNN: A novel classification scheme of encrypted traffic based on flow spatiotemporal features for efficient management of IIoT

Application traffic classification based on command exchange mode of TCP flows

An Improved Network Traffic Classification Algorithm Based on Hadoop Decision Tree

Internet Traffic Classification Based on Decision Tree

DarknetSec: A novel self-attentive deep learning method for darknet traffic classification and application identification

An Effective Network Traffic Classification Method with Unknown Flow Detection

Network Traffic Classification Using Tri-training Based on Statistical Flow Characteristics