Identification of Tor Anonymous Network Traffic Based on Machine Learning

Abstract

In order to identify Tor anonymous network traffic which was generated by the most widely used anonymous network in the world, analyzing the features that can be used to recognize Tor traffic based on meek pluggable transport, and proposing a method based on machine learning to classify Tor traffic. Tor traffic identification aimed at Tor-Meek traffic which using Meek traffic confusion technology in Tor network. To determine the flow characteristics that can be used to identify Tor traffic from the original feature set, RandomForest feature selection method is used to evaluate the importance of these features, and select the available feature subset. The Tor traffic classifier is constructed by using C4.5, RandomForest and KNN algorithms to identify Tor traffic. Experiment shows that Tor traffic identification methods based on three classification algorithms can effectively identify Tor anonymous network traffic, for different versions of Tor client, the precise and recall are all greater than 94% when identify Tor traffic.