Tor anonymous communication system's resource publishing is vulnerable to enumeration attacks. Zhao determines users who requested resources are unavailable as suspicious malicious users, and gradually reduce the scope of suspicious users through several stages to reduce the false positive rate. However, it takes several stages to distinguish users. Although this method successfully detects the malicious user, the malicious user has acquired many resources in the previous stages, which reduce the availability of the anonymous communication system. This paper proposes a detection method based on Integer Linear Program to detect malicious users who perform enumeration attacks on resources in the process of resource distribution. First, we need construct a bipartite graph between the unavailable resources and the users who requested for these resources in the anonymous communication system; next we use Integer Linear Program to find the minimum malicious user set. We simulate the resource distribution process through computer program, we perform an experimental analysis of the method in this paper is carried out. Experimental results show that the accuracy of the method in this paper is above 80%, when the unavailable resources in the system account for no more than 50%. It is about 10% higher than Zhao's method.

Detection of Sybil Attack on Tor Resource Distribution

Tor is widely used to protect users’ privacy, which is the most popular anonymous tool. Tor introduces multiple pluggable transports (PT) to help users avoid censorship. A number of traffic analysis methods have been devoted to de-anonymize these PT. Snowflake is the latest PT based on the WebRTC protocol and DTLS encryption protocol for peer-to-peer communication, differing from other PT, which defeat these traffic analysis methods. In this paper, we propose a Snowflake traffic identification framework, which can identify whether the user is accessing Tor and which hidden service he is visiting. Rule matching and DTLS handshake fingerprint features are utilized to classify Snowflake traffic. The linear interpolation of the accumulative payload length of the first n messages in the DTLS data transmission phase as additional features are extracted to identify the hidden service. The experimental results show that our identification framework F-ACCUMUL can effectively identify Tor-Snowflake traffic and Tor-Snowflake hidden service traffic.

https://www.mdpi.com/2076-3417/13/1/622/pdf?version=1672910392

F-ACCUMUL: A Protocol Fingerprint and Accumulative Payload Length Sample-Based Tor-Snowflake Traffic-Identifying Framework

Nowadays, most Internet applications are generally faced with various traffic monitoring and content monitoring threats. To protect business secrets and personal privacy, anonymous communication technology has attracted widespread attention. Anonymous communication technology not only provides protection of confidentiality, integrity and availability, but also hides communication relationships and routing information through onion routing and other technologies. Although anonymous communication networks can provide better security and confidentiality, the control plane of most anonymous communication networks still lacks adequate protection mechanisms. For example, the Tor network needs to explicitly download control information from a directory server. This method of obtaining control information exists security risks. This paper proposes a method for obtaining control information of anonymous network based on asynchronous communication. We use the public storage service of the Internet as a transit platform to exchange control information between the user terminal and the control center of the anonymous communication network, and design an automatic destruction mechanism to make the buffered control information on the public platform will not be obtained by third parties. This method is suitable for most anonymous communication networks and can effectively improve the protection of the control plane of anonymous communication networks.

Fading with the Time: A Traceless Access Scheme for Anonymous Communication Network

Tor is currently the most used anonymous browser. Users can communicate anonymously on the Internet through Tor and some criminals can use Tor for illegal and criminal activities. In order to deal with congestion, Tor introduced a bridge mechanism to replace the previous ingress node. Obfs4 is one of the most important bridges used by Tor. It uses an improved elliptic curve encryption algorithm and random padding to hide message information, the anti-detection ability is extremely strong. In order to effectively identify Obfs4 traffic, this paper proposes a Obfs4 identification method based on Multiple-feature fusion. Through research on Obfs4 protocol, data packet structure, node publishing strategy, and node distribution, this paper proposes many ways to obtain multiple features, including randomness characteristics, sequential characteristics, handshake packet length characteristics, and communication packet statistics characteristics. In addition, this paper proposes a machine learning algorithm based on a weighted Gaussian kernel function, which can modify the weight of different features to change the degree of influence of different features on the final classification result. Finally, the weight of each feature and the parameters used by the algorithm are determined through experiments. The accuracy of the algorithm is 93.82%, the recall is 99.00%, and the accuracy is 94.34%, which is much better than other algorithms mentioned in this paper. At the same time, this paper proves that there are some loopholes in Obfs4's anonymity mechanism, and its effective fingerprint can be obtained from the information it leaks to carry out attacks.

Obfs4 Traffic Identification Based on Multiple-feature Fusion

The ultimate Dark web will review the emerging research conducted to study and identify the ins and outs of the dark web. The world is facing a lot of issues day-by-day especially on the internet. Now I have a question here, do you think is working with the internet attains knowledge or it pretends to be a part of the business. Keep the business part aside, we all know that internet is a great tool for communication. Is internet is definitely giving privacy, safety and security. Does anyone have a brief idea about the dark web for all these queries we don’t have any accurate solution. Through this survey, I outlined some of the major concepts and their dependencies the primary usage of the dark web and some of the survey experiences are further documented in this paper.

/pdf/exploration-of-ultimate-dark-web-anonymization-privacy-and-3y0kgmwh3v.pdf

Exploration of Ultimate Dark Web Anonymization, Privacy, and Security

Tor (The second generation Onion Router) is the most popular anonymous communication network. In order to protect Tor user from traffic analysis attack, many obfuscation techniques are adopted and Obfs4 is one of the states of art techniques used in Tor. It is very hard to detect the Tor traffic camouflaged under Obfs4, especially in the real world when there is a large volume of various traffic, because of random padding and randomization of time sequence. In this paper, we propose a novel scheme for Obfs4 traffic detection based on two-level filtering. We sequentially utilize coarse-grained fast filtering and fine-grained accurate identification to achieve high-precision, real-time recognition of Obfs4 traffic. In the coarse-grained filtering phase, we use the randomness detection algorithm to detect the randomness of the handshake packet payload in the communication and use the timing sequence characteristics of the packet in the handshake process to remove other interference traffic. In the fine-grained identification phase, we analyze its statistical feature on a large number of Obfs4 traffic and use the classification algorithms to identify the Obfs4 traffic. We train and test with different classifiers. The experiments show that the accuracy for identifying Obfs4 is above 99% when using the SVM (Support Vector Machine) algorithm, which indicates that Obfs4 cannot effectively counteract traffic analysis attacks in practical applications.

Yongzhong He

Papers

Detection of Tor Traffic Hiding Under Obfs4 Protocol Based on Two-Level Filtering