The Onion Router (Tor) project has introduced pluggable transport technologies to hide its traffic from AI-based traffic analysis and detection. By adopting re-encryption, random padding, packet splitting, and other methods, these technologies change how Tor traffic looks and is distributed. Current encrypted traffic identification methods are designed for traffic with consistent properties and distributions due to the limitations of traditional supervised learning. They struggle to cope with the frequent changes in Tor traffic introduced by pluggable transport technologies. Inspired by the latest developments in AI, researchers suggest using unsupervised pre-training techniques for identifying encrypted traffic. This innovative approach aims to elevate the model’s generalization capabilities and enhance its performance in handling new types of traffic. However, the existing methods directly used to identify obfuscated Tor traffic still have two shortcomings. First, model fine-tuning and testing are not possible because there is no publicly available dataset containing obfuscated Tor traffic. Second, the existing models have high computational overhead, so they cannot be deployed on network devices with limited resources. Aiming at these shortcomings, we have carried out pioneer work for efficient identification of obfuscated Tor traffic. The novelty of our work lies in two points. First, we have developed an automated obfuscated Tor traffic collection system and constructed a high-quality dataset. Second, we propose TorHunter, a lightweight method for identifying obfuscated Tor traffic based on unsupervised learning. In input representation, TorHunter uses a single-byte encoding strategy to make the vocabulary smaller. It also selects a reasonable length to truncate the input sequence and decrease the number of parameters in the model. In model construction, a header-payload embedding layer is used to focus on key bytes for traffic identification. Additionally, we replace the Transformer with the Linformer to reduce computational overhead. To validate TorHunter, we carried out comparative experiments on two tasks. TorHunter achieves over \(99\%\) accuracy with only 0.79M parameters and 29.9M FLOPs, outperforming 6 state-of-the-art methods.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

TorHunter: A Lightweight Method for Efficient Identification of Obfuscated Tor Traffic Through Unsupervised Pre-training

  • Yuwei Xu,
  • Zhengxin Xu,
  • Jie Cao,
  • Rongrong Wang,
  • Yali Yuan,
  • Guang Cheng

摘要

The Onion Router (Tor) project has introduced pluggable transport technologies to hide its traffic from AI-based traffic analysis and detection. By adopting re-encryption, random padding, packet splitting, and other methods, these technologies change how Tor traffic looks and is distributed. Current encrypted traffic identification methods are designed for traffic with consistent properties and distributions due to the limitations of traditional supervised learning. They struggle to cope with the frequent changes in Tor traffic introduced by pluggable transport technologies. Inspired by the latest developments in AI, researchers suggest using unsupervised pre-training techniques for identifying encrypted traffic. This innovative approach aims to elevate the model’s generalization capabilities and enhance its performance in handling new types of traffic. However, the existing methods directly used to identify obfuscated Tor traffic still have two shortcomings. First, model fine-tuning and testing are not possible because there is no publicly available dataset containing obfuscated Tor traffic. Second, the existing models have high computational overhead, so they cannot be deployed on network devices with limited resources. Aiming at these shortcomings, we have carried out pioneer work for efficient identification of obfuscated Tor traffic. The novelty of our work lies in two points. First, we have developed an automated obfuscated Tor traffic collection system and constructed a high-quality dataset. Second, we propose TorHunter, a lightweight method for identifying obfuscated Tor traffic based on unsupervised learning. In input representation, TorHunter uses a single-byte encoding strategy to make the vocabulary smaller. It also selects a reasonable length to truncate the input sequence and decrease the number of parameters in the model. In model construction, a header-payload embedding layer is used to focus on key bytes for traffic identification. Additionally, we replace the Transformer with the Linformer to reduce computational overhead. To validate TorHunter, we carried out comparative experiments on two tasks. TorHunter achieves over \(99\%\) accuracy with only 0.79M parameters and 29.9M FLOPs, outperforming 6 state-of-the-art methods.