Multilevel Identification and Classification Analysis of Tor on Mobile and PC Platforms

Wang, Liangmin; Mei, Hantao; Sheng, Victor S.

doi:10.1109/tii.2020.2988870

Cited by 30 publications

(16 citation statements)

References 26 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The researchers in [11], [39], [40] proposed a framework based on network flow features for Tor traffic analysis and multi-level cataloging. The model can detect the anonymous traffic L1, L2, and L3 on multiple platforms, including mobile and PC.…”

Section: Related Workmentioning

confidence: 99%

“…The analysis of darknet traffic provides complete information to the cybersecurity specialists, and other IT operators about the services exploited by attackers or vulnerable to some attack [6], [7], [8], [9]. Researchers now focus on analyzing the darknet traffic, specifically detecting Tor applications to determine the malicious activities [10], [11], [12], [13], [14]. To achieve the detection objective, authors used ML, and Deep Learning (DL) techniques [15], [16], [17], [18].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

DarkDetect: Darknet Traffic Detection and Categorization Using Modified Convolution-Long Short-Term Memory

et al. 2021

View full text Add to dashboard Cite

Darknet is commonly known as the epicenter of illegal online activities. An analysis of darknet traffic is essential to monitor real-time applications and activities running over the Darknet. Recognizing network traffic bound to unused Internet addresses has become undeniably significant for identifying and examining malicious activities on the internet. Since there are no authentic hosts or devices in an unused address block, any observed network traffic must be the aftereffect of misconfiguration from spoofed source addressed and other frameworks that monitor unused address space. However, the recent advancements in artificial intelligence allow digital systems to detect and identify darknet traffic autonomously. In this paper, we propose a generalized approach for darknet traffic detection and categorization using Deep Learning. We examine the state-of-the-art complex dataset, which provides excessive information about the darknet traffic and perform data preprocessing. Next, we analyze diverse feature selection techniques to select optimal features for darknet traffic detection and categorization. We apply fine-tuned machine learning (ML) algorithms which include Decision Tree (DT), Gradient Boosting (GB), Random Forest Regressor (RFR), and Extreme Gradient Boosting (XGB) on selected features and compare the performance. Next, we apply modified Convolution-Long Short-Term Memory (CNN-LSTM) and Convolution-Gradient Recurrent Unit (CNN-GRU) deep learning techniques to recognize the network traffic more accurately. The results demonstrate that the proposed approach outperforms the existing approaches by yielding the maximum accuracy of 96% of darknet traffic detection and 89% of darknet traffic categorization through XGB as a feature selection approach and CNN-LSTM a recognition model.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

DarkDetect: Darknet Traffic Detection and Categorization Using Modified Convolution-Long Short-Term Memory

et al. 2021

View full text Add to dashboard Cite

show abstract

“…Due to the layered encryption of Tor network, we also assume that the attacker cannot learn anything about packet payload. Numerous studies [4,5,[8][9][10][11][12][13] have proposed techniques to perform website fingerprinting attacks. Most of them are first extract features such as packet length, packet direction and time are collected from traffic flow at the user's end, and then uses these features to train machine learning or deep learning models.…”

Section: Wf Attackmentioning

confidence: 99%

RBP: a website fingerprinting obfuscation method against intelligent fingerprinting attacks

et al. 2021

Self Cite

View full text Add to dashboard Cite

Edge computing has developed rapidly in recent years due to its advantages of low bandwidth overhead and low delay, but it also brings challenges in data security and privacy. Website fingerprinting (WF) is a passive traffic analysis attack that threatens website privacy which poses a great threat to user’s privacy and web security. It collects network packets generated while a user accesses website, and then uses a series of techniques to discover patterns of network packets to infer the type of website user accesses. Many anonymous networks such as Tor can meet the need of hide identity from users in network activities, but they are also threatened by WF attacks. In this paper, we propose a website fingerprinting obfuscation method against intelligent fingerprinting attacks, called Random Bidirectional Padding (RBP). It is a novel website fingerprinting defense technology based on time sampling and random bidirectional packets padding, which can covert the real packets distribution to destroy the Inter-Arrival Time (IAT) features in the traffic sequence and increase the difference between the datasets with random bidirectional virtual packets padding. We evaluate the defense against state-of-the-art website fingerprinting attacks in real scenarios, and show its effectiveness.

show abstract

“…Wang et al [5] proposed a Tor traffic identification and multilevel classification framework based on network flow features, which realizes the identification of anonymous traffic (L1), traffic types (L2) of anonymous traffic, and applications (L3) on a mobile and a PC platform, respectively, and further analyzed differences between the mobile and the PC platform. Gurunarayanan et al [6] developed a machine learning model to identify Tor traffic.…”

Section: Related Workmentioning

confidence: 99%

Encrypted Traffic Identification Method Based on Multi-scale Spatiotemporal Feature Fusion Model with Attention Mechanism

Huo¹,

Ge²,

Jiao³

et al. 2021

Proceedings of the 11th International Conference on Computer Engineering and Networks

View full text Add to dashboard Cite

With the increasing complexity of encryption protocols in recent years, the existing network traffic identification and classification methods are facing great challenges. Researchers have found that most of the improved methods for deep learning are achieved by increasing the width and depth of the network. However, a large number of parameters need to be calculated in the process of network training, which increase the computational complexity of the algorithm.To address the problems of different important features characterization, this paper proposes a new classification model, which firstly preprocesses original traffic, followed by extracting the spatial features by CNN layers, obtaining the temporal features from LSTM layers, and then we fuse multi-scale features before features are put into attention mechanism to improve the ability of feature representation. Finally, we validate the effectiveness of our method on handling the ISCXTor2016 dataset. The experimental results show that the classification algorithm proposed in this paper achieved the lowest loss and the highest accuracy in the identification of encrypted traffic.

show abstract

Multilevel Identification and Classification Analysis of Tor on Mobile and PC Platforms

Cited by 30 publications

References 26 publications

DarkDetect: Darknet Traffic Detection and Categorization Using Modified Convolution-Long Short-Term Memory

DarkDetect: Darknet Traffic Detection and Categorization Using Modified Convolution-Long Short-Term Memory

RBP: a website fingerprinting obfuscation method against intelligent fingerprinting attacks

Encrypted Traffic Identification Method Based on Multi-scale Spatiotemporal Feature Fusion Model with Attention Mechanism

Contact Info

Product

Resources

About