Digging into Anonymous Traffic: A Deep Analysis of the Tor Anonymizing Network

Chaabane, Abdelberi; Manils, Pere; Kâafar, Mohamed Ali

doi:10.1109/nss.2010.47

Cited by 82 publications

(70 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Almubayed et al [41] proposed a research has considered many ML algorithms to fingerprint Tor usage in the network. Chaabane et al [42] provides a deep analysis of both the HTTP and BitTorrent protocols giving a complete overview of their usage, depict how users behave on top of Tor and also show that Tor usage is now diverted from the onion routing concept and that Tor exit nodes are frequently used as 1-hop SOCKS proxies, through a so-called tunneling technique. Finally, Chakravarty et al proposed methods for performing traffic analysis using remote network bandwidth estimation tools, to identify the Tor relays and routers involved in Tor circuits [43,44].…”

Section: Related Workmentioning

confidence: 99%

Computational intelligence anti-malware framework for android OS

Demertzis¹,

Iliadis²

2017

Vietnam J Comput Sci

View full text Add to dashboard Cite

It is a fact that more and more users are adopting the online digital payment systems via mobile devices for everyday use. This attracts powerful gangs of cybercriminals, which use sophisticated and highly intelligent types of malware to broaden their attacks. Malicious software is designed to run quietly and to remain unsolved for a long time. It manages to take full control of the device and to communicate (via the Tor network) with its Command & Control servers of fastflux botnets' networks to which it belongs. This is done to achieve the malicious objectives of the botmasters. This paper proposes the development of the computational intelligence anti-malware framework (CIantiMF) which is innovative, ultra-fast and has low requirements. It runs under the android operating system (OS) and its reasoning is based on advanced computational intelligence approaches. The selection of the android OS was based on its popularity and on the number of critical applications available for it. The CIantiMF uses two advanced technology extensions for the ART java virtual machine which is the default in the recent versions of android. The first is the smart anti-malware extension, which can recognize whether the java classes of an android application are benign or malicious using an optimized multi-layer perceptron. The optimization is done by the employment of the biogeography-based optimizer algorithm. The second is the Tor online traffic identification extension, which is capable of achieving malware localization, Tor traffic identification B Konstantinos Demertzis kdemertz@fmenr.duth.gr Lazaros Iliadis

show abstract

Section: Related Workmentioning

confidence: 99%

Computational intelligence anti-malware framework for android OS

Demertzis¹,

Iliadis²

2017

Vietnam J Comput Sci

View full text Add to dashboard Cite

show abstract

“…Anonymized or encrypted communication hamper the investigation and might distract the analysis of the captured data. Tor [10] provides anonymity based on onion routing, I2P [46] uses a decentralized mix network that prevents the identification of the users [3]. analyses the traffic travelling through the Tor by using deep packet inspection techniques.…”

Section: Problemsmentioning

confidence: 99%

Challenges of Network Forensic Investigation in Virtual Networks

Spiekermann

Eggendorfer

2017

JCSM

View full text Add to dashboard Cite

The evolution of virtualization techniques is changing operating principles in today's datacenters. Virtualization of servers, networks and storage increases the flexibility and dynamic of the environment by reducing the administrative overhead. Based on a physical underlay network, different logical networks are implemented with new protocols like VXLAN, STT or GENEVE. New paradigms like Software-Defined-Networks or Network Function Virtualization offer new capabilities to redesign the whole network infrastructure. This trend creates new challenges for digital investigations analysing incidents by extracting and interpreting recorded data inside the environment. As a branch of digital investigation, network forensic investigation is used to examine network traffic by capturing the data of a suspicious target system and analysing this data. In this article, we analyse in detail new challenges in investigating virtual networks. We propose a classification in three categories, which might help to develop new methods and possible solutions to simplify further necessary investigations in virtual network environments. The defined challenges are classified according their potential to impede the investigation. Based on this classification we derive a list of basic conditions, describing different necessary requirements to implement a successful, valid and ongoing network forensic investigation in these virtual networks.

show abstract

“…The main congestion control mechanism used by Tor is an end-to-end window based system, where the exit relay and client use SENDME control cells to infer network level congestion. Tor separates data flowing inbound from data flowing outbound, 3 and congestion control mechanisms operate independently on each flow. Each circuit starts with an initial 1000 cell window which is decremented by the source edge node for every cell sent.…”

Section: Congestion Controlmentioning

confidence: 99%

“…Finally, the TorPerf clients only perform one download every 10 minutes, where the small, medium and large clients download 50 KiB, 1 MiB and 5MiB files respectively. This distribution of clients is used to approximate the findings of McCoy et al [23], Chaabane et al [3] and data from Tor [31].…”

Section: Experimental Setup and Modelmentioning

confidence: 99%

How Low Can You Go: Balancing Performance with Anonymity in Tor

Geddes

Jansen

Hopper

2013

Privacy Enhancing Technologies

View full text Add to dashboard Cite

Abstract. Tor is one of the most popular anonymity systems in use today, in part because of its design goal of providing high performance. This has motivated research into performance enhancing modifications to Tor's circuit scheduling, congestion control, and bandwidth allocation mechanisms. This paper investigates the effects of these proposed modifications on attacks that rely on network measurements as a side channel. We introduce a new class of induced throttling attacks in this space that exploit performance enhancing mechanisms to artificially throttle a circuit. We show that these attacks can drastically reduce the set of probable entry guards on a circuit, in many cases uniquely identifying the entry guard. Comparing to existing attacks, we find that although most of the performance enhancing modifications improve the accuracy of network measurements, the effectiveness of the attacks is reduced in some cases by making the Tor network more homogeneous. We conclude with an analysis of the total reduction in anonymity that clients face due to each proposed mechanism.

show abstract

Digging into Anonymous Traffic: A Deep Analysis of the Tor Anonymizing Network

Cited by 82 publications

References 7 publications

Computational intelligence anti-malware framework for android OS

Computational intelligence anti-malware framework for android OS

Challenges of Network Forensic Investigation in Virtual Networks

How Low Can You Go: Balancing Performance with Anonymity in Tor

Contact Info

Product

Resources

About