MVC-Corr: An accurate and efficient flow correlation method based on multi-view fusion and contrast augmentation

Abstract

Flow correlation attacks determine the access relationship between clients and services under conditions of multi-relay encrypted traffic by analyzing the behavior similarity of their data flows. However, the effectiveness of current flow correlation attacks is susceptible to traffic obfuscation and suffers from low training efficiency, which greatly restricts their application on Tor. To address this, the paper proposes an accurate and efficient flow correlation method named MVC-Corr, which is based on multi-view fusion and contrast augmentation. Firstly, a multi-view fusion feature extraction network (MVF) is designed. The network integrates three types of views: uplink–downlink interaction view, local view, and global view, to achieve precise feature extraction. Secondly, an offset intersection contrast augmentation mechanism (ICA) is developed. The mechanism generates non-correlated flow feature pairs with abundant contrast information, improving the efficiency of correlation analysis. Finally, to enhance the broad applicability of the proposed method across different target scales, MVC-Corr is designed with two operational modes, each tailored for the user tracking scenario and the user discovery scenario. The experimental results show that, in user tracking scenario, MVC-Corr outperforms three existing typical methods—DeepCorr, FlowTracker, and ResTor—in terms of accuracy, achieving improvements ranging from 13.3% to 30.9% under traffic obfuscation conditions. In user discovery scenario, experimental results demonstrate that MVC-Corr’s correlation capability surpasses that of the current state-of-the-art method, DeepCoFFEA, achieving a maximum true positive rate improvement of 2.9%.