Detecting Tor Snowflake as Anomalous WebRTC Traffic Under Extreme Class Imbalance

Abstract

Tor Snowflake employs the WebRTC protocol stack to circumvent network censorship by simulating conventional peer-to-peer browser communication. Despite modern trained detection algorithms achieving accuracies beyond 99% in laboratory conditions, these evaluations fail to consider the significant class imbalance present in operational contexts where circumvention is infrequent. In these circumstances, the base-rate fallacy induces a significant accuracy decline, resulting in the majority of positive identifications being false positives and making supervised approaches operationally infeasible. This study mitigates these deficiencies by utilizing a 36-dimensional protocol fingerprint vector to identify distinctive patterns in DTLS content types, STUN binding attributes, TLS record distributions, TCP flag configurations, and packet-level entropy. By training exclusively on standard network traffic, the framework recognises Snowflake traffic as structural anomalies without necessitating labeled circumvention samples. A systematic evaluation across realistic operational imbalance ratios indicates that the local outlier factor (LOF) demonstrates strong performance, attaining a 91.6% F1-score (86.0% precision, 98.0% recall) at 1000:1, while supervised classifiers collapse to 17.8–37.6% precision at the same ratio. Deep learning techniques (AE, VAE, GANomaly) attain intermediate performance, with F1-scores ranging from 68.7% to 87.3% at 1000:1.