Abstract:Tor is the most widely used anonymous communication system at present which can anonymize users' network behavior. At the same time, many illegal network activities also appear more frequently with the help of Tor, posing serious challenges for cyberspace security. Therefore, flow fingerprinting and flow correlation analysis methods are put forward to de-anonymize the malicious anonymous behaviors, which utilize external traffic features as the side-channel information. However, the adversary often reduces the ability of above two methods by adding the disturbance to the anonymous traffic. As a countermeasure against the interference, disturbance-resistant analysis methods can effectively identify those adversarial behaviors while knowing how the traffic is modified. However, in real scenarios, it is unrealistic to distinguish between disturbed and nondisturbed anonymous traffic, let alone to have a clear grasp of the disturbing strategy. In this paper, we propose a blind anonymous traffic analysis method called Blind Analyzer based on pattern reconstruction skills in a "masking-generation" manner. Specifically, Blind Analyzer extracts the pattern knowledge from non-disturbed traffic samples by masking and reconstructing them. During the method application, disturbed anonymous traces are processed following the same way, aiming at removing the incremental noise at the masking stage and restoring the original shape at the reconstruction stage. Besides, a conditional discriminator is designed to determine whether the generated sample has obvious class characteristics. Benefited from the proposed method, we can improve the effectiveness of the anonymous network behavior analysis since the disturbed traffic can be restored as normal ones accurately enough. Experiment results on three datasets show that reconstructed traffic samples output by Blind Analyzer are more useful for base analysis models, which improve the corresponding metric values by 11.23% and 6.61% in max for flow fingerprinting and correlation tasks, respectively.

FlowCorrGCN: Enhancing Flow Correlation Through Graph Convolutional Networks and Triplet Networks

FlowTracker: Improved Flow Correlation Attacks with Denoising and Contrastive Learning

Universal Perturbation for Flow Correlation Attack on Tor

Attention Based Graph Covolution Networks for Intelligent Traffic Flow Analysis

Discovering Attack Scenarios Via Intrusion Alert Correlation Using Graph Convolutional Networks

Seeing the Attack Paths: Improved Flow Correlation Scheme in Stepping-Stone Intrusion

Inter-Flow Spatio-Temporal Correlation Analysis Based Website Fingerprinting Using Graph Neural Network

Flow-based Encrypted Network Traffic Classification with Graph Neural Networks

A Correlation Information-based Spatiotemporal Network for Traffic Flow Forecasting

A Blind Flow Fingerprinting and Correlation Method Against Disturbed Anonymous Traffic Based on Pattern Reconstruction

Deep fused flow and topology features for botnet detection basing on pretrained GCN

Anonymous communication with network coding against traffic analysis attack

Dynamic Correlation Adjacency-Matrix-Based Graph Neural Networks for Traffic Flow Prediction

Breaking On-Chip Communication Anonymity using Flow Correlation Attacks

Spatial–Temporal-Correlation-Constrained Dynamic Graph Convolutional Network for Traffic Flow Forecasting

Flow Topology-Based Graph Convolutional Network for Intrusion Detection in Label-Limited IoT Networks

FlowDNS: Correlating Netflow and DNS Streams at Scale

FPCR-Net: Feature pyramidal correlation and residual reconstruction for optical flow estimation

Accurate mobile-app fingerprinting using flow-level relationship with graph neural networks

Tracing the Propagation Path: A Flow Perspective of Representation Learning on Graphs

Spatial–Temporal Complex Graph Convolution Network for Traffic Flow Prediction