A Survey on Tor Encrypted Traffic Monitoring

Abstract

Tor (The Onion Router) is an anonymity tool that is widely used worldwide. Tor protect its user privacy against surveillance and censorship using strong encryption and obfuscation techniques which makes it extremely difficult to monitor and identify users' activity on the Tor network. It also implements strong defense to protect the users against traffic features extraction and website fingerprinting. However, the strong anonymity also became the heaven for criminal to avoid network tracing. Therefore, numerous of research has been performed on encrypted traffic analyzing and classification using machine learning techniques. This paper presents survey on existing approaches for classification of Tor and other encrypted traffic. There is preliminary discussion on machine learning approaches and Tor network. Next, there are comparison of the surveyed traffic classification and discussion on their classification properties.

CBS: A Deep Learning Approach for Encrypted Traffic Classification With Mixed Spatio-Temporal and Statistical Features

“…In recent years, the academic and industrial communities have paid much attention to traffic classification [12], [28]- [32]. Traditional techniques for traffic classification, like port-based and deep packet inspection (DPI), are no longer adequate due to the exponential growth in encrypted traffic [33]- [35].…”

De-Anonymisation Attacks on Tor: A Survey

“…Also, note that this report has not been cited in any other publication previously. [2] 2009 Survey existing anonymous communication systems 6 Salo [9] 2010 Survey Tor attacks 10 Nepal et al [15] 2015 Survey de-anonymisation attacks on hidden services 3 Erdin et al [14] 2015 Survey de-anonymisation attacks on users 19 Yang et al [38] 2015 Classification of de-anonymisation techniques 6 AlSabah et al [10] 2016 Survey the research on performance and security of Tor 22 Evers et al [13] 2016 Survey Tor attacks 38 Saleh et al [11] 2018 Survey all aspects of Tor research 23 Aminuddin et al [39] 2018 Survey existing approaches for classifying Tor traffic N/A Kohls et al [40] 2018 An evaluation framework for confirmation attacks 10 Cambiaso et al [12] 2019 Survey Tor attacks 13 Basyoni et al [16] 2020 end passive attacks, congestion and timing attacks as endto-end active attacks, and fingerprinting attacks as single-end passive attacks. Our paper contains more de-anonymisation attacks on Tor when compared with [13], including 17 attacks since 2016, which makes our paper the most comprehensive paper on de-anonymisation attacks to date.…”

“…Several other works have been associated with Tor attacks but focus on a different aspect of Tor research. For example, Aminuddin et al [39] investigate the existing literature on Tor traffic classification. Their work focuses on how machine learning techniques have been applied to such classifications and compares those techniques.…”

“…Their work focuses on how machine learning techniques have been applied to such classifications and compares those techniques. The authors in [39] present a traffic classification taxonomy based on input, method, and output. The input data is categorised into circuit, flow, and packet features, while the method is categorised into supervised, semi-supervised, and unsupervised categories.…”

“…Almost 14 previous works have been referenced in this survey. The authors in [39] claim that no classification algorithm can be presented as superior as the algorithm's efficiency and capabilities depend on the classification objective, implementation strategy, and the training dataset. Aminuddin et al suggest that the five factors; accuracy, training time, computational resources, number of features, and number of parameters must be considered when deciding the right algorithm for any situation.…”