Research On Traffic Identification Of Tor Anonymous Traffic Based On FTE

Tor(The second generation Onion Router)not only protects user privacy on the Internet,but also become a criminal tool for cybercrime.Moreover,Tor has made it more difficult to identify Tor traffic by deploying multiple types of Pluggable Transports(PTs),which can confuse and disguise Tor anonymous traffic.FTE is one of the official default PT integrated in Tor.For these reasons,port-based traffic identification does not work in the field of Tor traffic identification.Deep Packet Inspection(DPI)technology can be bypassed by FTE easily.In view of these problems,this paper analyzes the advantages and disadvantages of existing traffic identification techniques.On the basis of anonymous traffic identification model based on Na?ve Bayesian,anonymous traffic identification model based on Bayesian Network and anonymous traffic identification model based on C4.5 Decision Tree,this paper proposes a Tor anonymous traffic identification technology based on FTE.First of all,based on the characteristics of Tor anonymous traffic and the related traffic identification methods,this paper constructs an efficient anonymous traffic identification model.Secondly,in order to identify Tor anonymous traffic accurately and efficiently,and improve the performance of the model,this paper deeply studies and statistically analyzes the Tor anonymous traffic based on FTE.As a result,this paper finds out some typical features of FTE-based Tor anonymous traffic,which different from the normal traffic,including 15 features based on the packet size and packet arrival time interval.Finally,according to these features,the constructed Tor anonymous traffic identification model is trained and tested in the actual experimental environment.What's more,the technology is evaluated comprehensively from the perspectives of model differences,feature weights and sample size.Experimental results show the effectiveness of this method.The realization of Tor anonymous traffic identification technology based on FTE not only can effectively identify the anonymous traffic from the normal network traffic,but also has very important practical application value for maintaining the national network security.