A novel application classification attack against Tor

Abstract

SUMMARYTor is a famous anonymous communication system for preserving users' online privacy. It supports TCP applications and packs upper-layer application data into encrypted equal-sized cells with onion routing to hide private information of users. However, we note that the current Tor design cannot conceal certain application behaviors. For example, P2P applications usually upload and download files simultaneously, and this behavioral feature is also kept in Tor traffic. Motivated by this observation, we investigate a new attack against Tor, application classification attack, which can recognize application types from Tor traffic. An attacker first carefully selects some flow features such as burst volumes and directions to represent the application behaviors and takes advantage of some efficient machine-learning algorithm (e.g., Profile Hidden Markov Model) to model different types of applications. Then he or she can use these established models to classify target's Tor traffic and infer its application type. We have implemented the application classification attack on Tor using parallel computing, and our experiments validate the feasibility and effectiveness of the attack. We argue that the disclosure of application type information is a serious threat to Tor users' anonymity because it can be used to reduce the anonymity set and facilitate other attacks. We also present guidelines to defend against application classification attack.

A Survey on Tor Encrypted Traffic Monitoring

“…Due to the complexity of encrypted traffic, most of the surveyed research focuses on supervised machine learning which required pre-training dataset to classify the traffic. The studies by [33], [36] utilized unsupervised machine learning solely for traffic clustering rather than traffic classification. Despite study by [34] managed to classify encrypted traffic using semi-supervised learning, this learning practice could be achieved with the presence of hierarchical classification approach.…”

“…These records than will be fragmented into the TCP packets before it will be send to another Tor node. These traffic layer mechanism enable features extraction of the traffic at three different levels for the machine traffic classification process as each layer has certain header information that are not encrypted [33].…”

“…There is study on application classification attack on Tor network [33] which identify and classify the application types inside the Tor network traffic. The identification is based on application behaviour that characterized by traffic flow features such as burst volumes and directions.…”

“…This approach would allow for the Tor traffic to be monitored in large scale and real-time. Although it is not directly deanonymized the user activity on the Tor network, learning the application information that being used by the users in the Tor network is a part of the Tor privacy concern [33]. This security monitoring capabilities could be achieved using machine learning classification technique similar to the classification of encrypted traffic on the surface web.…”

Mobile app identification for encrypted network flows by traffic correlation

“…The most important challenge is that apps deliver their data predominantly using Hypertext Transfer Protocol (HTTP)/Hypertext Transfer Protocol Secure (HTTPS) and may contact the same content or ad servers, so port-based and Internet Protocol (IP)-based methods will fail. For the same reason, traditional approaches 13,14 for identifying desktop applications are too coarse grained for mobile apps. To address this problem, several recent studies [15][16][17][18][19] have been conducted and various types of identification techniques have been proposed.…”