DeepCorr

Abstract

Flow correlation is the core technique used in a multitude of deanonymization attacks on Tor. Despite the importance of ow correlation attacks on Tor, existing ow correlation techniques are considered to be ine ective and unreliable in linking Tor ows when applied at a large scale, i.e., they impose high rates of false positive error rates or require impractically long ow observations to be able to make reliable correlations. In this paper, we show that, unfortunately, ow correlation attacks can be conducted on Tor tra c with drastically higher accuracies than before by leveraging emerging learning mechanisms. We particularly design a system, called DeepCorr, that outperforms the state-of-the-art by signicant margins in correlating Tor connections. DeepCorr leverages an advanced deep learning architecture to learn a ow correlation function tailored to Tor's complex network-this is in contrast to previous works' use of generic statistical correlation metrics to correlate Tor ows. We show that with moderate learning, DeepCorr can correlate Tor connections (and therefore break its anonymity) with accuracies signi cantly higher than existing algorithms, and using substantially shorter lengths of ow observations. For instance, by collecting only about 900 packets of each target Tor ow (roughly 900KB of Tor data), DeepCorr provides a ow correlation accuracy of 96% compared to 4% by the state-of-the-art system of RAPTOR using the same exact setting.We hope that our work demonstrates the escalating threat of ow correlation attacks on Tor given recent advances in learning algorithms, calling for the timely deployment of e ective countermeasures by the Tor community.

Hidden service publishing flow homology comparison using profile‐hidden markov model

“…Active correlation attacks usually refer to the artificial implementation of interference factors including watermarks 4 and traffic replay 6 on hijacked flow with less disturbed observation effect by the environment, and lack concealment measures. Passive correlation attacks, 8–10 a mainstream in current research areas, have simple deployment and significant attack performance. The attacker only observes and counts the two‐way flow at a fixed location and then imports traffic data to the background for granularity analysis.…”

“…In the case of unreliable network transmission conditions or encrypted flow generated by small targets such as P2P, Web browsing, file transfer protocol (FTP), and instant messaging (IM), 9 a large‐scale flow sequence comparison is required to reach a high accuracy rate. If an attack model encounters a small target similar to the descriptor publishing flow, the probability of a high false‐positive rate will be increased, 10 greatly obstructing the ideal attack benefits. The DeepCorr attack system designed by Nasr et al 10 broke through the traditional statistical measurement method, which relied on the flow correlation function for Tor.…”

“…Flow correlation attack 7–11 is an attack technology that conducts a targeted analysis of encrypted flow. The attacker needs to observe the two‐way encrypted flow on the entry and exit sides to apply the identification model for flow correlation.…”

“…The difficulty in implementing traditional correlation attacks 3,10–12 is to control the entry and exit positions of the circuit. In the context of the HS descriptor publishing, the exit side is replaced by an autonomously controlled hidden service directory server (HSDir).…”

“…The size leads to deviations between the descriptor publishing flow sequences. Using the traditional correlation attack model, 7,10 it is impossible to accurately capture the deviations between sequences in a short period of time. This is because it lacks accurate positioning of target sequences scattered within the communication flow, and the recognition sensitivity of the small targets is also low.…”