| Tor(The Onion Router),as one of the most popular anonymous communication tools,ensures the privacy of users’ browsing activities by encrypting the content of communication and routing information.However,while Tor protects the privacy of user communications,it also makes cybercriminal activities difficult to regulate.Website fingerprinting technology can effectively monitor Tor-based cybercriminals,by analyzing the traffic between the censored person and the anonymous network,and then identifying the websites visited by the censored person.However,most of the current research on website fingerprinting technology is based on the assumption that the censors only visit one website at a time,and in the real environment,the censors often open multiple websites at the same time.Starting from the limitations of the current website fingerprinting technology,this paper studies the overlapping Tor traffic generated in the scenario of accessing multiple websites through the Tor network at the same time,and constructs the overlapping Tor traffic segmentation model and website fingerprinting model to improve the adaptability and robustness of website fingerprinting technology.The main work of this paper includes the following parts:First,collect overlapping Tor traffic data and perform data preprocessing on it.This paper describes and implements the collection of overlapping Tor traffic data in detail.Based on the encapsulation principle of Tor data packets,the sequence of Tor network data packets is processed into a sequence of cells(a sequence consisting of+1 and-1)as the input of the neural network model.Finally,99,663 pieces of overlapping Tor traffic data were obtained,and the labeling of the data was completed.Secondly,a convolutional neural network-based overlapping Tor traffic segmentation algorithm is proposed and implemented,and atrous convolution is introduced to improve the neuron’s perception field and improve the overall performance of the model,so as to accurately find the segmentation point in the overlapping Tor traffic.Through experimental tests,the overlapping Tor traffic segmentation algorithm proposed in this paper can achieve a segmentation accuracy rate of more than 90%,which is better than the existing overlapping Tor traffic segmentation algorithms.Finally,a website fingerprinting algorithm based on attention mechanism and LSTM(Long Short Term Memroy)is proposed and implemented,which is used to identify incomplete and non-overlapping Tor traffic after segmentation.The algorithm first builds a multi-branch LSTM network to fit the temporal features that are difficult to quantitatively analyze in the Tor traffic packet sequence,and also prevents problems such as long model training time and vanishing gradients.In addition,an attention mechanism is introduced to optimize the weight parameters of temporal features,so as to highlight the influence of key temporal features on the results of website fingerprinting and improve the accuracy of website fingerprinting.Through experimental tests,the TPR(True Positive Rate)of the website fingerprinting algorithm proposed in this paper can reach 86%,which is better than the existing website fingerprinting algorithms. |
