Detection of Tor Traffic Hiding Under Obfs4 Protocol Based on Two-Level Filtering
Detection of Tor Traffic Hiding Under Obfs4 Protocol Based on Two-Level Filtering
复制标题
基于两级过滤的Obfs4协议下Tor流量隐藏检测
DOI：
10.1109/icdis.2019.00036
复制
发表时间：
2019
期刊：
影响因子：
--
通讯作者：
Ruimei Gao
中科院分区：
文献类型：
--
作者：
Yongzhong He;Liping Hu;Ruimei Gao
Tor（第二代洋葱路由器）是最流行的匿名通信网络。为了保护Tor用户免受流量分析攻击，采用了许多混淆技术，Obfs4是Tor中使用的最先进技术之一。由于随机填充和时间序列的随机性，Obfs 4下的Tor流量检测非常困难，特别是在真实的世界中，各种流量大量存在的情况下。在本文中，我们提出了一种新的方案Obfs4流量检测的基础上两级过滤。我们依次采用粗粒度快速过滤和细粒度准确识别，实现高精度，实时识别的Obfs4流量。在粗粒度过滤阶段，利用随机性检测算法检测通信中握手包载荷的随机性，利用握手过程中数据包的时序特性去除其他干扰流量。在细粒度识别阶段，我们分析了大量的Obfs4流量的统计特征，并使用分类算法来识别Obfs4流量。我们使用不同的分类器进行训练和测试。实验表明，使用SVM（Support Vector Machine）算法识别Obfs4的准确率在99%以上，说明Obfs4在实际应用中不能有效抵御流量分析攻击。
Tor (The second generation Onion Router) is the most popular anonymous communication network. In order to protect Tor user from traffic analysis attack, many obfuscation techniques are adopted and Obfs4 is one of the states of art techniques used in Tor. It is very hard to detect the Tor traffic camouflaged under Obfs4, especially in the real world when there is a large volume of various traffic, because of random padding and randomization of time sequence. In this paper, we propose a novel scheme for Obfs4 traffic detection based on two-level filtering. We sequentially utilize coarse-grained fast filtering and fine-grained accurate identification to achieve high-precision, real-time recognition of Obfs4 traffic. In the coarse-grained filtering phase, we use the randomness detection algorithm to detect the randomness of the handshake packet payload in the communication and use the timing sequence characteristics of the packet in the handshake process to remove other interference traffic. In the fine-grained identification phase, we analyze its statistical feature on a large number of Obfs4 traffic and use the classification algorithms to identify the Obfs4 traffic. We train and test with different classifiers. The experiments show that the accuracy for identifying Obfs4 is above 99% when using the SVM (Support Vector Machine) algorithm, which indicates that Obfs4 cannot effectively counteract traffic analysis attacks in practical applications.