De-Anonymisation Attacks on Tor: A Survey

Karunanayake, Ishan; Ahmed, Nadeem; Malaney, Robert; Islam, Rafiqul; Jha, Sanjay

doi:10.1109/comst.2021.3093615

Cited by 44 publications

(19 citation statements)

References 85 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Note that all the clients can only obtain proxies information from the proxy distributor, which is a reasonable assumption exploited in rBridge [13] and HypoTor [15] as well. Network‐level proxy identification attacks such as traffic fingerprinting attacks, man‐in‐the‐middle attacks, and probing attacks are not considered in the proxy distribution issue since the existing defense mechanisms against these kinds of attacks have been proved effective and practical [36].…”

Section: System Model and Related Metricsmentioning

confidence: 99%

Blind matching algorithm based proxy distribution against internet censorship

Shi

Guo

et al. 2023

IET Communications

View full text Add to dashboard Cite

Proxy based censorship circumvention technique is treated as one of the most promising approaches to fighting against Internet censorship, and its practical applications like the onion router and Lantern have been widely utilized. However, the proxy distribution, as a basic and core issue, still remains unsolved due to (i) the finiteness and non‐renewable nature of proxy resources, (ii) the heterogeneity of clients and proxies requirements, and (iii) the existence of secondary censorship. In this paper, a win‐win driven proxy distribution mechanism for proxy based censorship circumvention systems is designed by leveraging the blind matching theory. Specifically, a combinational manner is developed to measure the quality of service (QoS) requirements of clients in terms of normalized bandwidth and reliability, and security requirements of proxies in terms of credits and suspicion. Then, by introducing the concept of virtual currency, the proxy distribution issue is formulated as two‐sided combinatorial problems from the perspective of clients and proxies, respectively. To solve the complex NP‐hard combinatorial problems in a win‐win manner without unilateral dominance, a two‐sided many‐to‐many context‐free matching game is constructed, in which the aspiration levels and agreement functions are defined to capture the security and QoS concerns of clients and proxies. Further, a modified notion of pairwise stability is exploited as the solution concept, and a client‐proxy blind matching algorithm with market and information decentralization is proposed to obtain the ε‐pairwise stable solution, where clients and proxies make encounters randomly and update their aspiration levels through a stochastic learning process. Finally, theoretical analysis and numerical results are carried out to validate the properties and performance of the proposed algorithm including stability, complexity, and convergence.

show abstract

Section: System Model and Related Metricsmentioning

confidence: 99%

Blind matching algorithm based proxy distribution against internet censorship

Shi

Guo

et al. 2023

IET Communications

View full text Add to dashboard Cite

show abstract

“…Tor adopts perfect forward secrecy and multi-layer proxy technology to ensure data confidentiality, making Tor traffic difficult to trace and providing a new way for criminals to commit crimes. Malicious users abuse the Tor network to hide their attacks and damage the security of communication systems, such as arms, hacker dealing, child pornography and botnets [2]. Therefore, Tor traffic tracking is crucial for maintaining network security and combating cybercrime.…”

Section: Introductionmentioning

confidence: 99%

“…These features have small intra-class gaps but large inter-class gaps, which can characterise the Tor traffic of different applications. (2) We propose FlowMFD, a finer-grained Tor traffic classification method using MFDCF and spatial-temporal modelling. (3) Extensive experiments conducted on the ISCXTor2016 and self-collected datasets show that FlowMFD significantly outperforms other state-of-the-art methods in terms of accuracy and Macro-F1, demonstrating its superiority in classifying specific Tor applications.…”

Section: Introductionmentioning

confidence: 99%

FlowMFD: Characterisation and classification of tor traffic using MFD chromatographic features and spatial–temporal modelling

Wang

Cheng

et al. 2023

IET Information Security

View full text Add to dashboard Cite

Tor traffic tracking is valuable for combating cybercrime as it provides insights into the traffic active on the Tor network. Tor-based application traffic classification is one of the tracking methods, which can effectively classify Tor application services. However, it is not effective in classifying specific applications due to more complicated traffic patterns in the spatial and temporal dimensions. As a solution, the authors propose FlowMFD, a novel Tor-based application traffic classification approach using amount-frequencydirection (MFD) chromatographic features and spatial-temporal modelling. Expressly, FlowMFD mines the interaction pattern between Tor applications and servers by analysing the time series features (TSFs) of different size packets. Then MFD chromatographic features (MFDCF) are designed to represent the pattern. Those features integrate multiple low-dimensional TSFs into a single plane and retain most pattern information. In addition, FlowMFD utilises a cascaded model with a two-dimensional convolutional neural network (2D-CNN) and a bidirectional gated recurrent unit to capture spatialtemporal dependencies between MFDCF. The authors evaluate FlowMFD under the public ISCXTor2016 dataset and the self-collected dataset, where we achieve an accuracy of 92.1% (4.2%↑) and 88.3% (4.5%↑), respectively, outperforming state-of-the-art comparison methods.

show abstract

“…On a technical level, available tools are far from perfect. The Tor project [70] although popular with 2M active users [68], is vulnerable to de-anonymization [40], denial of service (DoS) [35], and traffic analysis [52]. Because Tor can be automatically fingerprinted [25,64], it is also easy to block (ironically, the authors of this paper themselves were blocked from accessing the Tor project's website on their organization network).…”

Section: Introductionmentioning

confidence: 99%

With a Little Help from My Friends: Transport Deniability for Instant Messaging

Nelson¹,

Askarov²

2022

Preprint

View full text Add to dashboard Cite

Traffic analysis for instant messaging (IM) applications continues to pose an important privacy challenge. In particular, transport-level data can leak unintentional information about IM -such as who communicates with whom. Existing tools for metadata privacy have adoption obstacles, including the risks of being scrutinized for having a particular app installed, and performance overheads incompatible with mobile devices. We posit that resilience to traffic analysis must be directly supported by major IM services themselves, and must be done in a low-cost manner without breaking existing features. As a first step in this direction, we propose a hybrid messaging model that combines regular and deniable messages. We present a novel protocol for deniable instant messaging, which we call DenIM. DenIM is built on the principle that deniable messages can be made indistinguishable from regular messages with a little help from a user's friends. Deniable messages' network traffic can then be explained by a plausible cover story. DenIM achieves overhead proportional to the messages sent, as opposed to scaling with time or number of users. To show the effectiveness of DenIM, we implement a trace simulator, and show that DenIM's deniability guarantees hold against strong adversaries such as internet service providers.

show abstract

De-Anonymisation Attacks on Tor: A Survey

Cited by 44 publications

References 85 publications

Blind matching algorithm based proxy distribution against internet censorship

Blind matching algorithm based proxy distribution against internet censorship

FlowMFD: Characterisation and classification of tor traffic using MFD chromatographic features and spatial–temporal modelling

With a Little Help from My Friends: Transport Deniability for Instant Messaging

Contact Info

Product

Resources

About