Research On Website Fingerprint Identification Technology Of Tor Network

In recent years,the number of users of anonymous communication networks represented by Tor has increased rapidly.The anonymous communication network has these characteristics:hidden communication nodes,hidden communication relationships,difficult to track service,and difficult on user monitoring,making it gradually become a high incidence of cybercrime activities such as online black market transactions,ransomware deployment,and personal information trafficking.Therefore,it is necessary to further strengthen the supervision of anonymous communication networks to combat criminal acts carried out by means of anonymous communication networks.Website fingerprinting technology can analyze the information of dark web websites accessed by users through encrypted tunnels,monitor or review anonymous encrypted traffic,which is of great significance.At present,machine learning and deep learning technologies have been widely used in the field of website fingerprinting.The construction of website traffic fingerprint features changes from the traditional method of manually selecting features based on the experience and technical knowledge about how Tor and HTTP protocols work and interact,to a new way of automatically extracting traffic fingerprint features.The main work of this paper is as follows:(1)A Tor website fingerprint recognition model based on genetic algorithm optimization of convolutional neural network is proposed.On the basis of analyzing the characteristics of Tor traffic,the original Tor traffic records are preprocessed and input into the constructed convolutional neural network CNN,and the global optimization ability of the genetic algorithm is used to automatically find hyperparameters,optimize the convolutional neural network,and implement automatic extraction of Tor traffic features and website fingerprinting.After experiments,the performance of the fingerprint recognition method and the previous fingerprint attack research in the closed-world dataset and the open-world dataset are compared,and the results show that the recognition accuracy of the model has been improved to a certain extent.(2)A hierarchical spatiotemporal Tor website fingerprinting model based on multi-head attention mechanism is proposed.By introducing attention mechanism to assign different weights to input features to highlight important features,multi view spatial features of input data are extracted and fused by parallel multi-channel convolution neural network,LSTM network is used to extract temporal features,and softmax function is used to classify.After experimental verification,compared with the single network model,the model has improved recognition accuracy,training efficiency,and generalization ability in the open-world binary classification problem and the closed-world multi-classification problem.(3)Combining the two proposed website fingerprinting models,a Tor network website fingerprinting system is designed and implemented,which supports capturing anonymous traffic,traffic identification,visualization of identification results and other functions,and realizes the identification and analysis of Tor network traffic in the network,provide support for strengthening darknet supervision.