Research On Tor Anonymous Network Traffic Classificatio

The Internet provides users with convenient and fast life services,but also comes with various risks and crises brought by the network,privacy and security have become a key concern,and anonymous communication networks have emerged.Anonymous communication networks hide the key information of both sides of the communication,and at the same time,various anonymous communication techniques hide the link established by both sides of the communication,so that the communication cannot be traced from the communication link,thus ensuring the anonymity of the network.Tor anonymous communication network is the anonymous communication network with the largest number of participants,so it is important to identify and classify the traffic of Tor anonymous network to maintain network order and network information security.In this paper,we adopt a deep learning-based research method to carry out research on two tasks of Tor anonymous network traffic identification and traffic type classification,and the main research contents are as follows.1.A Tor traffic TCP-Payload feature engineering method is proposed.The method uses sliding windows to segment packet TCP-Payload byte sequences,and controls the feature loss generated during byte sequence segmentation by sliding windows,thus preserving Tor traffic features.2.A Payload2 Vec pre-training model is proposed.The method reduces the training parameters of subsequent classification models to speed up the training and performs well on recognition and classification tasks.3.The MABL model with multi-head self-attention mechanism is proposed.The model establishes a Bi-LSTM-based encoder-decoder structure for the typical temporal characteristics of Tor anonymous network traffic and introduces a multi-head selfattention mechanism,thus improving the model training accuracy and recall.Through experiments on the dataset ISCXTor2016,compared with other models,the MABL model proposed in this paper shows significant improvements in Tor anonymous network traffic identification and traffic type classification tasks,respectively.