Active Tor Website Fingerprint Recognition

Abstract

Abstract: The anonymous communication system Tor is often exploited by criminals, disrupting the network environment and social stability. Website fingerprinting can effectively monitor Tor activities. However, user behavior and website content on Tor change over time, leading to the problem of concept drift, which degrades model performance. Additionally, existing models suffer from large parameter sizes and low efficiency. To address these issues, a Tor website fingerprinting model based on active learning, named TorAL, is proposed. This method utilizes the image classification model ShuffleNetV2 for feature extraction and classification, and improves its downsampling module with Haar wavelet transform to losslessly reduce image resolution. The model’s recognition accuracy surpasses that of existing models. Moreover, by combining active learning, the model is trained with a small amount of highly contributive data, effectively addressing the concept drift problem.

Key words: Tor(the onion router), website fingerprint recognition, darknet, convolutional neural network, active learning

摘要： 匿名通信系统洋葱路由(the onion router, Tor)易被不法分子利用，破坏网络环境和社会稳定，网站指纹识别能对其有效监管.Tor用户行为和网站内容随时间变化，产生概念漂移问题，使模型性能下降，且现有模型参数量大、效率低.针对上述问题，提出基于主动学习的Tor网站指纹识别模型TorAL(Tor active learning)，将图像分类模型ShuffleNetV2用于特征提取和分类，使用Haar小波变换改进其下采样模块，以无损降低图像分辨率，模型识别准确率优于现有模型.此外，结合主动学习，用少量对模型贡献较大的数据进行训练，有效应对概念漂移问题.

关键词: 洋葱路由, 网站指纹识别, 暗网, 卷积神经网络, 主动学习

CLC Number:

TP309.2

朱懿, 蔡满春, 姚利峰, 陈咏豪, 张溢文, . 主动Tor网站指纹识别[J]. 信息安全研究, 2025, 11(5): 439-.

References

［1］刘宝旭, 李昊, 孙钰杰, 等. 智能化漏洞挖掘与网络空间威胁发现综述［J］. 信息安全研究, 2023, 9(10): 932939［2］Dingledine R, Mathewson N, Syverson P. Tor: The secondgeneration onion router［C］ Proc of USENIX Security Symp. Berkeley, CA: USENIX Association, 2004: 303320［3］Cambiaso E, Vaccari I, Patti L, et al. Darknet security: A categorization of attacks to the Tor network［C］ Proc of the Italian Conf on CyberSecurity. Pisa, ITA: ITASEC, 2019: 112［4］Basyoni L, Fetais N, Erbad A, et al. Traffic analysis attacks on Tor:A survey［C］ Proc of 2020 IEEE Int Conf on Informatics, IoT, and Enabling Technologies. Piscataway, NJ: IEEE, 2020: 183188［5］孙学良, 黄安欣, 罗夏朴, 等.针对Tor的网页指纹识别研究综述［J］. 计算机研究与发展, 2021, 58(8): 17731788［6］Peek J, Soukup D, ejka T. Active learning framework to automate network traffic classification［J］. arXiv preprint, arXiv:2211.08399, 2022［7］Torres J L G, Catania C A, Veas E. Active learning approach to label network traffic datasets［J］. Journal of Information Security and Applications, 2019, 49: 102388［8］Hintz A. Fingerprinting websites using traffic analysis［C］ Proc of Int Workshop on Privacy Enhancing Technologies. Berlin: Springer, 2002: 171178［9］Herrmann D, Wendolsky R, Federrath H. Website fingerprinting: Attacking popular privacy enhancing technologies with the multinomial navebayes classifier［C］ Proc of the 2009 ACM Workshop on Cloud Computing Security. New York: ACM, 2009: 3142［10］Abe K, Goto S. Fingerprinting attack on Tor anonymity using deep learning［J］. Proc of the AsiaPacific Advanced Network, 2016, 42: 1520［11］Rimmer V, Preuveneers D, Juarez M, et al. Automated website fingerprinting through deep learning［J］. arXiv preprint, arXiv:1708.06376, 2017［12］Bhat S, Lu D, Kwon A, et al. VarCNN: A dataefficient website fingerprinting attack based on deep learning［J］. arXiv preprint, arXiv:1802.10215, 2018［13］Wang W, Zhu M, Zeng X, et al. Malware traffic classification using convolutional neural network for representation learning［C］ Proc of 2017 Int Conf on Information Networking. Piscataway, NJ: IEEE, 2017: 712717［14］He G, Yang M, Gu X, et al. A novel active website fingerprinting attack against Tor anonymous system［C］ Proc of the 18th IEEE Int Conf on Computer Supported Cooperative Work in Design. Piscataway, NJ: IEEE, 2014: 112117［15］Nissim N, Cohen A, Elovici Y. ALDOCX: Detection of unknown malicious microsoft office documents using designated active learning methods based on new structural feature extraction methodology［J］. IEEE Trans on Information Forensics and Security, 2016, 12(3): 631646［16］Kumari V V, Varma P R K. A semisupervised intrusion detection system using active learning SVM and fuzzy cmeans clustering［C］ Proc of 2017 Int Conf on IoT in Social, Mobile, Analytics and Cloud. Piscataway, NJ: IEEE, 2017: 481485［17］Wassermann S, Cuvelier T, Mulinka P, et al. ADAM & RAL: Adaptive memory learning and reinforcement active learning for network monitoring［C］ Proc of the 15th Int Conf on Network and Service Management. Piscataway, NJ: IEEE, 2019: 19［18］Dong S. Multi class SVM algorithm with active learning for network traffic classification［J］. Expert Systems with Applications, 2021, 176: 114885［19］He X, Wang J, He Y, et al. A deep learning approach for website fingerprinting attack［C］ Proc of the 4th IEEE Int Conf on Computer and Communications. Piscataway, NJ: IEEE, 2018: 14191423［20］Sirinam P, Imani M, Juarez M, et al. Deep fingerprinting: Undermining website fingerprinting defenses with deep learning［C］ Proc of the 2018 ACM SIGSAC Conf on Computer and Communications Security. New York: ACM, 2018: 19281943［21］Rahman M S, Sirinam P, Mathews N, et al. Tiktok: The utility of packet timing in website fingerprinting attacks［J］. arXiv preprint, arXiv:1902.06421, 2019［22］马陈城, 杜学绘, 曹利峰, 等. 基于深度神经网络burst特征分析的网站指纹攻击方法［J］. 计算机研究与发展, 2020, 57(4): 746766［23］Ma N, Zhang X, Zheng H T, et al. Shufflenet v2: Practical guidelines for efficient CNN architecture design［C］ Proc of the European Conf on Computer Vision. Berlin: Springer, 2018: 116131［24］Yoo D, Kweon I S. Learning loss for active learning［C］ Proc of the IEEECVF Conf on Computer Vision and Pattern Recognition. Piscataway, NJ: IEEE, 2019: 93102［25］Stankovi R S, Falkowski B J. The Haar wavelet transform: Its status and achievements［J］. Computers & Electrical Engineering, 2003, 29(1): 2544［26］Sandler M, Howard A, Zhu M, et al. Mobilenetv2: Inverted residuals and linear bottlenecks［C］ Proc of the IEEE Conf on Computer Vision and Pattern Recognition. Piscataway, NJ: IEEE, 2018: 45104520［27］Xu G, Liao W, Zhang X, et al. Haar wavelet downsampling: A simple but effective downsampling module for semantic segmentation［J］. Pattern Recognition, 2023, 143: 109819

[1]	. Interaction Perception Attention Network Between Layers for #br# Fewshot Malicious Domain Name Detection#br# [J]. Journal of Information Security Reserach, 2025, 11(1): 50-.
[2]	. Model of Intrusion Detection Based on Federated Learning and Convolutional Neural Network [J]. Journal of Information Security Reserach, 2024, 10(7): 642-.
[3]	. A Network Intrusion Detection Model Integrating CNN-BiGRU and Attention Mechanism [J]. Journal of Information Security Reserach, 2024, 10(3): 202-.
[4]	. Encrypted Proxy Traffic Identification Method Based on Convolutional Neural Network#br# [J]. Journal of Information Security Reserach, 2023, 9(8): 722-.
[5]	. Research on Automatic Recognition Technology of Gambling Website [J]. Journal of Information Security Reserach, 2023, 9(5): 440-.
[6]	. Research on Malicious Behavior Detection and Identification Model Based on Deep Learning [J]. Journal of Information Security Reserach, 2023, 9(12): 1152-.
[7]	. Intrusion Detection Method Based on Multiscale Spatialtemporal Residual Network [J]. Journal of Information Security Reserach, 2023, 9(11): 1045-.
[8]	. [J]. Journal of Information Security Reserach, 2022, 8(8): 760-.
[9]	. DGCNN-based Exploit Kit Attack Activities Detection Method [J]. Journal of Information Security Reserach, 2022, 8(7): 685-.
[10]	. Research on Source Code Vulnerability Detection Based on Abstract Syntax Tree Compression Coding [J]. Journal of Information Security Reserach, 2022, 8(1): 35-.
[11]	. Darknet Market Named Entity Recognition Based on Deep Learning [J]. Journal of Information Security Research, 2021, 7(1): 37-43.
[12]	. Malware Detection Based on Word Embedding Features of Assembly Instruction [J]. Journal of Information Security Research, 2020, 6(2): 113-121.
[13]	. A Framework for Proactive Acquisition of Threat Intelligence Based on Darknet [J]. Journal of Information Security Research, 2020, 6(2): 131-138.
[14]	. Abnormal Detection in Modbus TCP Based on Convolutional Neural Network [J]. Journal of Information Security Research, 2019, 5(7): 635-638.
[15]	. Android Malware Detection Algorithm Based on CNN and Naive Bayesian Method [J]. Journal of Information Security Research, 2019, 5(6): 470-476.