Research And Implementation Of Tor Hidden Service Fingerprinting Identification Attack Based On Deep Learning

Since the introduction of the hidden service protocol,the Tor anonymous communication network has quickly become a breeding ground for many illegal activities such as drug and gun transactions,money laundering,and data theft thanks to its strong anonymity,difficult service positioning,and difficult user monitoring.Therefore,strengthening the supervision of illegal activities in the Tor network is of great significance.Researchers have proposed a large number of hidden service fingerprint recognition methods based on manually designed features and machine learning.However,research has shown that these methods generally have biased recognition performance in open world scenarios.To address this issue,this thesis explores the application of deep learning in Tor covert service fingerprint recognition attacks.The main contributions of this thesis are as follows:Firstly,propose Tor hidden service fingerprinting recognition attack model based Transformer THFA.This model is designed based on the original Transformer encoder structure,grouping the traffic packet sequences of the preprocessing layer to meet the learning needs of the feature extraction layer.Source2Token multidimensional attention learning is performed on the feature vectors of different levels output by different Transformer layers.Finally,dimensionality is reduced through maximum pooling and average pooling,and concatenated to input to the website corresponding to the classifier’s traffic recognition.Compared to previous covert service fingerprint attack techniques,the THFA model has significantly improved the accuracy of website recognition.It can achieve 97.63%accuracy in the classification task of 900 websites in a closed world scenario,and 93.76%true positive rate and 4.62%false positive rate in an open world scenario with a scale of 400000 websites.Secondly,we designed and implemented a Tor hidden service fingerprinting recognition system THFS based on THFA.The system includes five modules:user management module,traffic collection module,fingerprint recognition module,anonymous files management module,and model iteration update module.Firstly,the system listens to the Socks5 protocol port of the entry node connecting to the user client,collects traffic,and processes it into Tor unit sequence format.Then,the system uses the THFA model as the core to fingerprint the anonymous network access traffic of Tor users.Finally,the traffic identified as the monitored website is archived and stored as anonymous users and access records according to its IP address,realizing the supervision of the users of the dark network and the review of anonymous network traffic.