Abstract:Tor is the most widely used anonymous communication system at present which can anonymize users' network behavior. At the same time, many illegal network activities also appear more frequently with the help of Tor, posing serious challenges for cyberspace security. Therefore, flow fingerprinting and flow correlation analysis methods are put forward to de-anonymize the malicious anonymous behaviors, which utilize external traffic features as the side-channel information. However, the adversary often reduces the ability of above two methods by adding the disturbance to the anonymous traffic. As a countermeasure against the interference, disturbance-resistant analysis methods can effectively identify those adversarial behaviors while knowing how the traffic is modified. However, in real scenarios, it is unrealistic to distinguish between disturbed and nondisturbed anonymous traffic, let alone to have a clear grasp of the disturbing strategy. In this paper, we propose a blind anonymous traffic analysis method called Blind Analyzer based on pattern reconstruction skills in a "masking-generation" manner. Specifically, Blind Analyzer extracts the pattern knowledge from non-disturbed traffic samples by masking and reconstructing them. During the method application, disturbed anonymous traces are processed following the same way, aiming at removing the incremental noise at the masking stage and restoring the original shape at the reconstruction stage. Besides, a conditional discriminator is designed to determine whether the generated sample has obvious class characteristics. Benefited from the proposed method, we can improve the effectiveness of the anonymous network behavior analysis since the disturbed traffic can be restored as normal ones accurately enough. Experiment results on three datasets show that reconstructed traffic samples output by Blind Analyzer are more useful for base analysis models, which improve the corresponding metric values by 11.23% and 6.61% in max for flow fingerprinting and correlation tasks, respectively.

Less is More: Mitigating Tor Traffic Correlation with Distance-Aware Path Selection.

Understanding Path Reconstruction Algorithms in Multihop Wireless Networks

Network Coding Based Privacy Preservation Against Traffic Analysis in Multi-Hop Wireless Networks

Multi-variant Network Address Hopping to Defend Stealthy Crossfire Attack

A Study on Security Analysis of the Unlinkability in Tor

A Weight-Based Attack Model in Road Networks

A Novel Method to Prevent Traffic Analysis in Low-Latency Anonymous Communication Systems

Universal Perturbation for Flow Correlation Attack on Tor

Node Selection-Based Anonymous Network Performance Optimization Method

Seeing the Attack Paths: Improved Flow Correlation Scheme in Stepping-Stone Intrusion

FlowTracker: Improved Flow Correlation Attacks with Denoising and Contrastive Learning

Adaptive Path Selection for Link Loss Inference in Network Tomography Applications

SaTor: Satellite Routing in Tor to Reduce Latency

A Stealthy Attack Against Tor Guard Selection

Disjoint-Path Selection in Internet: What traceroutes tell us?

A distance-based network activity correlation framework for defeating anonymization overlays

A Blind Flow Fingerprinting and Correlation Method Against Disturbed Anonymous Traffic Based on Pattern Reconstruction

Mitigating Traffic Analysis Attack In Smartphones With Edge Network Assistance

FlowCorrGCN: Enhancing Flow Correlation Through Graph Convolutional Networks and Triplet Networks

Adaptive Meek Technology for Anti-Traffic Analysis

Cost Efficient Internet Path Tracking Based on Routing Changes Prediction.