Tor Association Traceability Technology Based On Multilayer Control

Internet are becoming extremely pervasive,posing a grave threat to Internet users' privacy.As the anonymizing networks becomes more popular,anonymizing overlays such as Tor can improve user privacy.Using services like Tor,however has its downside,primarily because of the abuse of the service by criminal elements,which further hindering the discovery of illegal activities and tracing of criminals.To trace the source of malicious users on anonymous networks,this thesis takes the source tracing in Tor(The Second Onion Router)as the research topic.This thesis focuses on the anonymity principle in Tor,how to improve the malicious onion routing node under different factors probability is selected to effectively control onion routing,how to effectively control onion routing circuit traffic and improve the traceable traffic of malicious onion circuits can be analyzed,so that anonymous message senders and receivers can be correlated through onion circuit control.This thesis studies Tor's related traceability from two levels: node and circuit.Node control is a necessary prerequisite for associative traceability and the cornerstone of subsequent circuit control.The node control part analyzes the probability of malicious onion routing nodes being selected at different locations when the onion circuit is established.This study analyzes the factors that influence the selection of location nodes such as the entrance,middle,and exit of onion routing,such as bandwidth,flags,country,autonomous domain,and Tor version.This thesis use the Onion measurement protocol to measure the real Tor network.The probability of malicious onion routing being selected is increased effectively at each location by comparing the probability of nodes being selected under different factors at different locations.This thesis concludes that the probability in the guard is increased by 4.51%.The probability in the middle is increased by 150.80%,and the probability in the exit is increased by 42.35%.The circuit control part first analyzes the onion connection during onion circuit data transmission,and models the Tor multiplexing mechanism.Subsequently,Tor multiplexing mechanism improve the analyzable connections of malicious circuits by filtering the unanalyzable connections of malicious circuits.Finally,the onion cells on the malicious circuit is decrypted and the original payload is recorded,which results in the anonymous message sender and receiver of the malicious circuit associated.The research was conducted and deployed in the real Tor,and it was successfully verified that the method can accurately associate anonymous message senders and receivers,and the traceable traffic of malicious circuits is 2.61 times that of ordinary circuits.