Abstract: In order to solve the problem of difficulty in correctly classifying Tor traffic and regulating it due to the encryption characteristics of Tor links, a Tor traffic classification method based on an improved bidirectional memory residual neural network (CBAMBiMRNet) is proposed. Firstly, the SMOTETomek (SMOTE and Tomek links) comprehensive sampling algorithm is adopted to balance the dataset, so that the model could learn from the traffic data of all categories. Secondly, CBAM is used to assign greater weights to important features, combining 1D convolution with bidirectional long shortterm memory modules to extract temporal and local spatial features of Tor traffic data. Finally, by adding identity maps, the phenomenon of gradient vanishing and exploding caused by the increase in model layers was avoided, and the problem of network degradation was solved. The experimental results show that on the ISCXTor2016 dataset, the accuracy of our model for Tor traffic recognition reached 99.22%, and the accuracy for Tor traffic application service type classification reached 93.10%, proving that the model can effectively recognize and classify Tor traffic.

Key words: Tor traffic, residual network, traffic identification, integrated sampling, class imbalance

摘要： 为了解决Tor链路加密的特性导致模型难以对Tor流量进行正确分类导致监管困难的问题，提出了一种基于改进双向记忆残差网络(convolutional block attention modulebidirectional memory residual neural network, CBAMBiMRNet)的Tor流量分类方法.首先，采用SMOTETomek(SMOTE and tomek links)综合采样算法平衡数据集，使模型能够对各类流量数据进行充分学习.其次，采用CBAM为重要的特征赋予更大的权值，将1维卷积与双向长短期记忆模块结合起来，提取Tor流量数据的时间特征和局部空间特征.最后，通过添加恒等映射避免因模型层数的增加而出现的梯度消失和梯度爆炸现象，并且解决了网络退化问题.实验结果表明，在ISCXTor2016数据集上，该模型对Tor流量识别的准确率达到99.22%，对Tor流量应用服务类型分类的准确率达到93.10%，证明该模型能够有效地对Tor流量进行识别和分类.

关键词: Tor流量, 残差网络, 流量识别, 综合采样, 类别不平衡