Critical traffic analysis on the tor network

Platzer, Florian; Schäfer, Marcel; Steinebach, Martin

doi:10.1145/3407023.3409180

Cited by 7 publications

(6 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Prior research [44,66] revealed distinct network connection patterns for these two kinds of flows. However, it is uncertain whether these attacks still work given the recent introduction of circuit padding [40,67]. Yet, we confirmed that Tor's current version still presents differences that allowed us to devise a new classifier that accurately separates clients from onion services.…”

Section: Filtering Phasementioning

confidence: 54%

“…This defensive countermeasure against circuit fingerprinting effectively neutralized the attack outlined by Kwon et al on recent versions of Tor [40,41]. Other studies [67] have confirmed that padding cells notably diminish the success rate of deanonymization attacks reliant on the analysis of Tor circuits' cells. In light of this, we seek to develop an updated circuit fingerprinting technique that will act as a pre-filtering stage prior to applying the classifier for flow correlation of Tor onion service sessions.…”

Section: Circuit Fingerprinting For Tor Onion Service Trafficmentioning

confidence: 75%

“…To counter this second issue, Kwon et al [44] proposed circuit fingerprinting, which is capable of accurately distinguishing clients from onion services engaged in onion service sessions. However, despite its proven efficacy in mitigating class imbalance issues, their technique has fallen short due to recent updates in Tor protocols, in particular, the application of padding schemes, rendering Tor cell counting estimation more difficult [51,67]. The flow correlation attack presented in our study serves as a response to these challenges.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Flow Correlation Attacks on Tor Onion Service Sessions with Sliding Subset Sum

Lopes,

Dong,

Castro

et al. 2024

Proceedings 2024 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

Tor is one of the most popular anonymity networks in use today. Its ability to defend against flow correlation attacks is essential for providing strong anonymity guarantees. However, the feasibility of flow correlation attacks against Tor onion services (formerly known as "hidden services") has remained an open challenge. In this paper, we present an effective flow correlation attack that can deanonymize onion service sessions in the Tor network. Our attack is based on a novel distributed technique named Sliding Subset Sum (SUMo), which can be deployed by a group of colluding ISPs worldwide in a federated fashion. These ISPs collect Tor traffic at multiple vantage points in the network, and analyze it through a pipelined architecture based on machine learning classifiers and a novel similarity function based on the classic subset sum decision problem. These classifiers enable SUMo to deanonymize onion service sessions effectively and efficiently. We also analyze possible countermeasures that the Tor community can adopt to hinder the efficacy of these attacks.

show abstract

Section: Filtering Phasementioning

confidence: 54%

Section: Circuit Fingerprinting For Tor Onion Service Trafficmentioning

confidence: 75%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Flow Correlation Attacks on Tor Onion Service Sessions with Sliding Subset Sum

Lopes,

Dong,

Castro

et al. 2024

Proceedings 2024 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

show abstract

“…A completely secure system is not suitable. Although Tor is not foolproof yet, anonymity is good enough [38].…”

Section: Hidden Service Protocolmentioning

confidence: 99%

The Anonymity of the Dark Web: A Survey

2022

View full text Add to dashboard Cite

The dark web is a section of the Internet that is not accessible to search engines and requires an anonymizing browser called Tor. Its hidden network and anonymity pave the way for illegal activities and help cybercriminals to execute well-planned, coordinated, and malicious cyberattacks. Cyber security experts agree that online criminal activities are increasing exponentially, and they are also becoming more rampant and intensified. These illegal cyber activities include various destructive crimes that may target a single person or a whole nation, for example, data breaches, ransomware attacks, black markets, mafias, and terrorist attacks. So, maintaining data privacy and secrecy is the new dilemma of the era. This paper has extensively reviewed various attacks and attack patterns commonly applied in the dark web. We have also classified these attacks in our unique trilogies classification system. Furthermore, a detailed overview of existing threat detection techniques and their limitations is discussed for anonymity providing services like Tor, I2P, and Freenet. Finally, the paper has identified significant weaknesses that make the dark web vulnerable to different attacks.

show abstract

“…This article only needs traffic analysis of two nodes to achieve the basic goal. Recently, Platzer et al (2020) proposed a kind of introduction circuit attack based on statistical analysis which mainly uses the introduction circuits by controlling multiple key nodes and threatens the real location of the hidden services. The authors take the upcircuit & downcircuit loads during the creation and transmission of the introduction circuit as the basic features to judge the specific circuit location of the hidden services at the malicious nodes.…”

Section: Circuit Traffic Analysismentioning

confidence: 99%

Hidden Service Circuit Reconstruction Attacks Based on Middle Node Traffic Analysis

Meng¹,

Fei²

2021

International Journal of Digital Crime and Forensics

View full text Add to dashboard Cite

Traffic analysis is widely considered as an attack posing a threat to anonymity of the communication and may reveal the real identity of the users. In this paper, a novel anonymous circuit reconstruction attack method that correlates the circuit traffic is proposed. This method then reconstructs a complete communication tunnel using the location of middle nodes found between the hidden and client services. The attack process includes independent determination of the location of the malicious nodes. A traffic correlation framework of AutoEncoder + CNN + BiLSTM is established, based on the Generative Adversarial Networks (GAN) model. BiLSTM applies the packet size and packet interval features of bidirectional traffic and combines the reconstruction loss function with the discrimination loss function to achieve correlated traffic evaluation. After balancing the reconstruction loss and discrimination loss scores, the simulation results confirm that the identification performance of the proposed system is higher than the advanced models.

show abstract

Critical traffic analysis on the tor network

Cited by 7 publications

References 14 publications

Flow Correlation Attacks on Tor Onion Service Sessions with Sliding Subset Sum

Flow Correlation Attacks on Tor Onion Service Sessions with Sliding Subset Sum

The Anonymity of the Dark Web: A Survey

Hidden Service Circuit Reconstruction Attacks Based on Middle Node Traffic Analysis

Contact Info

Product

Resources

About