TOR anonymity network traffic recognition method integrating protocol information fusion
Yang Gang1，Jiang Zhou1，Zhang Jiaoting1，Wang Junyong1，Wang Qiang2,3，Zhang Yan1
1 360 Digital Security Technology Group Co., Ltd., Beijing 100020, China;2 Institute of Information Engineering, CAS, Beijing 100093, China;3 School of Cyber Security, University of Chinese Academy of Sciences, Beijing 100049, China
Abstract： Traffic analysis in the TOR（The Onion Router） anonymous network has become a challenging task. With the iterative updates of TOR′s obfuscation techniques, the introduction of the OBFS4 obfuscation protocol has made it increasingly difficult to detect TOR traffic. This paper provided a detailed study of TOR′s behavioral features, incorporating features of the OBFS4(ObjectBased File System4) obfuscation protocol algorithm to enhance the capability of detecting obfuscated traffic. In addition, this paper constructed a dataset covering various tunnel types, including web browsing, video streaming, and chat, to conduct experiments.The results show that the proposed method has significant effect on TOR traffic detection tasks based on the OBFS4 obfuscation protocol. The use of the lightGBM model has achieved the best detection performance, with an accuracy of 9889% when combining protocol features. Our approach was tested on various versions of TOR traffic, and the accuracy in detecting different versions of TOR traffic exceeded 97% in all cases.
Key words : TOR; obfuscation protocol features; behavioral features；lightGBM
