Abstract:Tor is the most widely used anonymous communication system at present which can anonymize users' network behavior. At the same time, many illegal network activities also appear more frequently with the help of Tor, posing serious challenges for cyberspace security. Therefore, flow fingerprinting and flow correlation analysis methods are put forward to de-anonymize the malicious anonymous behaviors, which utilize external traffic features as the side-channel information. However, the adversary often reduces the ability of above two methods by adding the disturbance to the anonymous traffic. As a countermeasure against the interference, disturbance-resistant analysis methods can effectively identify those adversarial behaviors while knowing how the traffic is modified. However, in real scenarios, it is unrealistic to distinguish between disturbed and nondisturbed anonymous traffic, let alone to have a clear grasp of the disturbing strategy. In this paper, we propose a blind anonymous traffic analysis method called Blind Analyzer based on pattern reconstruction skills in a "masking-generation" manner. Specifically, Blind Analyzer extracts the pattern knowledge from non-disturbed traffic samples by masking and reconstructing them. During the method application, disturbed anonymous traces are processed following the same way, aiming at removing the incremental noise at the masking stage and restoring the original shape at the reconstruction stage. Besides, a conditional discriminator is designed to determine whether the generated sample has obvious class characteristics. Benefited from the proposed method, we can improve the effectiveness of the anonymous network behavior analysis since the disturbed traffic can be restored as normal ones accurately enough. Experiment results on three datasets show that reconstructed traffic samples output by Blind Analyzer are more useful for base analysis models, which improve the corresponding metric values by 11.23% and 6.61% in max for flow fingerprinting and correlation tasks, respectively.

Adaptive Meek Technology for Anti-Traffic Analysis

Network Traffic Obfuscation Against Traffic Classification

SMART: A Lightweight and Reliable Multi-Path Transmission Model against Website Fingerprinting Attacks

MATEC: A lightweight neural network for online encrypted traffic classification

Classifying Tor Traffic Encrypted Payload Using Machine Learning

TMEC: A Trust Management Based on Evidence Combination on Attack-Resistant and Collaborative Internet of Vehicles

Maybenot: A Framework for Traffic Analysis Defenses

A2C: Anti-Attack Counters for Traffic Measurement

A Study on Security Analysis of the Unlinkability in Tor

A Blind Flow Fingerprinting and Correlation Method Against Disturbed Anonymous Traffic Based on Pattern Reconstruction

A Heuristic Statistical Testing Based Approach for Encrypted Network Traffic Identification.

Adversarial Malicious Encrypted Traffic Detection Based on Refined Session Analysis

Obfuscated Tor Traffic Identification Based on Sliding Window.

Beyond known threats: A novel strategy for isolating and detecting unknown malicious traffic

Website Detection Using Remote Traffic Analysis

Anteater: Advanced Persistent Threat Detection With Program Network Traffic Behavior

Machine Learning-Powered Encrypted Network Traffic Analysis: A Comprehensive Survey.

Detection and analysis of eavesdropping in anonymous communication networks

Adversarial Attacks Against Profile HMM Website Fingerprinting Detection Model

Efficient and Low Overhead Website Fingerprinting Attacks and Defenses based on TCP/IP Traffic

An Encrypted Malicious Traffic Detection System Based on Neural Network