Research On Behavior Simulation Technology Of Own-node In Tor Anonymous Communication System

The Onion Routing(Tor)mainly uses proxy forwarding and encryption technology to ensure The anonymity of both sides of communication.As a low-delay anonymous communication technology with The most mature technology and The largest number of users,its security has been widely concerned.In recent years,Tor traffic analysis attack technology has been developing continuously.Attackers can effectively identify most OF Tor traffic by using traffic analysis technology based on machine learning,and then block or even trace the source,posing a major threat to the security of Tor anonymous communication.Therefore,this thesis proposes a traffic obfuscation method,which simulates two adjacent nodes on a Tor circuit as Telegram encrypted voice call user nodes,and disguises Tor traffic between the two nodes as Telegram voice call traffic,so as to avoid Tor traffic recognition based on traffic characteristics and improve the anonymity of Tor.This thesis studies Tor node communication behavior simulation and traffic distribution characteristics simulation from two perspectives.The specific research contents are as follows:(1)Tor node communication behavior simulation.First of all,through Telegram official API call,imitate Telegram user login process and voice communication process,including the exchange of AES symmetric key and the establishment of voice call connection.Secondly,Tor packets are intercepted and modified at the firewall location,which is divided into sender and receiver.At the sending end,Tor packet is modified as Telegram packet by modifying packet header and packet length filling and segmentation.The receiver uses the same method to restore Telegram packets to original Tor packets,making Tor traffic between the two nodes disguised as Telegram voice call traffic.(2)Tor traffic distribution characteristics simulation.Firstly,the probability quality function and cumulative distribution function of packet length in the data traffic of source process(Tor)and target process(Telegram)are obtained,and then the matrix for traffic deformation is solved according to the source distribution and target distribution.Where,each element of the matrix represents the probability of deforming from the source packet length to a certain target packet length with minimum overall extra overhead.For packets of a certain length generated in the source process,the deformed target length can be obtained by sampling the deformation matrix,so as to reduce the extra cost brought by the traffic camouflage process.The experimental results show that the pseudo traffic generated by Tor nodes with the function of communication behavior simulation is able to resist the traffic analysis attacks based on machine learning.Moreover,using appropriate deformation matrix can effectively reduce the extra cost of generating flow.