Application Detection in Anonymous Communication Networks

Considering the wide application of network communication in the past two decades and the need to protect users' privacy, tools have been developed to make the users' activity unobservable. However, some organizations prevent access to these tools and greatly improved their technical capabilities. To be continuously available for users, these tools must be unobservable to censorship organizations. Considering the importance of unobservability of anonymity tools, this study shows three anonymity tools, including TOR, UltraSurf, and ScrambleSuit, have weaknesses against data flow analysis by designing a supervised classification system. This system works based on machine learning and traffic classification techniques considering a set of features and the correlation between data flows of each application. In the first step, it classifies data flows through a set of extracted statistical features including packet number, size, time interval, etc. Then, the pattern of sessions are evaluated to identify anonymity tools with a higher certainty. Considering the complexities involved in each tool, the obtained results are acceptable implying that the proposed system can be extended to identify other applications.