匿名通信技术的滥用给网络监管带来了新的挑战.有效识别出匿名通信流量,是阻止该类技术滥用的前提,具有重要的研究意义和应用价值.现有研究工作侧重于匿名通信关系的确认,无法用于匿名通信流量的识别和阻塞.针对这个问题,围绕广泛使用的T0r匿名通信系统,深入分析运行机制,归纳总结其流量特征.在此基础上,分别提出基于TLS指纹和基于报文长度分布的Tor匿名通信流量识别方法对两种识别方法的优缺点和适用性进行了详细分析和讨论,并通过CAIDA数据集和在线部署对识别方法进行了验证.实验结果表明,基于TLS指纹和基于报文长度分布的识别方法均能有效识别出Tor匿名通信流量.
Abuse of anonymous communication systems has introduced new challenges into network administration. The effective identification of anonymous communication traffic is a prerequisite to prevent such abuse; thus, this is fundamentally important for both theoretical researches and practical applications. Existing researches mainly focus on the confirmation of anonymous communication relationship and cannot be used to identify and block anonymous communication traffic. To solve this problem, the operation mechanism is deeply analyzed and traffic characteristics are summarized for the widely used Tor anonymous communication system. On this basis, a TLS fingerprint-based and packet-size distributions based methods are proposed to identify Tor anonymous communication traffic, respectively. The advantages, disadvantages and applicability of these two methods are analyzed and discussed in detail, and are validated by CAIDA dataset and online deployment. Experimental results prove that both methods are effective in identifying Tot anonymous communication traffic.