Traffic Analysis Attacks on Tor: A Survey

Tor is a popular anonymous network that provides the dark web called the hidden service not accessible with traditional web browsers. The number of hidden services using Tor's anonymous network has been steadily increasing every year with the demand of user privacy concerns as well as illegal services that abuse Tor's anonymity. As a result, how to collect and analyze the contents of Tor hidden service is not yet in full swing. In addition, due to the slow access speed of the Tor browser, it is difficult to observe the dynamics of the hidden services. In this work, we present an efficient Tor hidden service crawling method that can monitor the status of hidden services for the analysis of authentic hidden service contents. We have designed our Tor crawler with the virtualization software, Docker, and parallel Tor browsers to improve the crawling performance. In order to maximize the utilization, we analyzed the collected Tor hidden services by a clustering technique and reduced the crawling targets. Crawling time was 76% improved with 5 Docker containers with 5 browsers. From clustering same hidden services, we can also reduce 39% of crawling the Tor hidden services. From January 1, 2018 to May 31, 2018, we collected 25,261 onion addresses and found 2,527 unique hidden services. We crawled this hidden services twice a day, collect 456,739 HTML pages. We classified 722 hidden services contents and analyzed the Tor hidden service dynamics through collected HTML pages and crawler's log data. As a result, we found that the percentage of illegal services is higher in hidden services, which is actually in service.

We investigate the feasibility of mounting a de-anonymization attack against Tor and similar low-latency anonymous communication systems by using NetFlow records. Previous research has shown that adversaries with the ability to eavesdrop in real time at a few internet exchange points can effectively monitor a significant part of the network paths from Tor nodes to destination servers. However, the capacity of current networks makes packet-level monitoring at such a scale quite challenging. We hypothesize that adversaries could use less accurate but readily available monitoring facilities, such as Cisco’s NetFlow, to mount large-scale traffic analysis attacks. In this paper, we assess the feasibility and effectiveness of traffic analysis attacks against Tor using NetFlow data. We present an active traffic analysis technique based on perturbing the characteristics of user traffic at the server side, and observing a similar perturbation at the client side through statistical correlation. We evaluate the accuracy of our method using both in-lab testing and data gathered from a public Tor relay serving hundreds of users. Our method revealed the actual sources of anonymous traffic with 100% accuracy for the in-lab tests, and achieved an overall accuracy of 81.6% for the real-world experiments with a false positive rate of 5.5%.

Information technology is developing rapidly, especially in the field of computer science, telecommunications and information systems. In the early days of telecommunications, voice networks could not be combined with data networks. However, more recently it became possible to integrate data, audio and video services onto a single network, known as a multimedia network. The capabilities of the Internet are also rapidly increasing, and now, in addition to data packets (email, web browsing) the Internet transfers audio and video packets. Voice over Internet Protocol (VoIP) is a multimedia service. This technology can be used to transmit audio, video, and data packets. Consequently, it is becoming the most preferred communications technology. VoIP will eventually replace the use of traditional telephony – Public Switched Telephone Networks (PSTN), although the switchover process is challenging. A chief concern it that, while PSTN transmits audio packets over a closed network, VoIP sends audio packets using an open network – the Internet. In PSTN, eavesdroppers must have direct access to physical network to obtain information from communications. Whereas with VoIP, eavesdroppers can monitor data packets from they are connected to the Internet. Hence, security and privacy are important considerations when switching to VoIP systems. One solution is anonymous systems, which can be used to implement security and privacy protocols. However, this typically reduces the Quality of Service (QoS) of the VoIP. This empirical research study examines VoIP performance in an anonymous network – The Onion Routing (Tor). Two scenarios are implemented using the real Tor network to investigate three QoS metrics for VoIP: latency, jitter and packet loss. As recommended, latency in VoIP should be less than 400 ms, jitter should be less than 50 ms and packet loss should not be more than 5%. In addition, the research calculates the probability of attackers in the two scenarios implemented and evaluate Tor network forecasting. Experiments were conducted in reference to two scenarios. The first scenario is VoIP calls routed through a Tor network with three Tor relays (default Tor). And the second scenario is VoIP calls routed through a Tor network with two Tor relays. Experiments were performed in three periods; December 2012, July 2013, and October 2013. During each experimental time period, a hundred calls were captured for each scenario. Experimental results show that the QoS of VoIP over the two Tor relays was better than the VoIP over the three Tor relays. However, a probability of attackers calculation found that the VoIP with three Tor relays returned better anonymity than that with two Tor relays. The best results were returned over the experimental period in July 2013, when the acceptable calls using two Tor relays reached 64 calls at 5% packet loss. Meanwhile, the worst experimental results were returned in October 2013, when acceptable calls numbered 11 using three Tor relays at 1% packet loss. At the end of 2013, the actual data for relay numbers and bandwidth approached forecast result with time series analysis. Meanwhile, the numbers of Tor users differed from the Tor users forecast. In August 2013, Tor users increased dramatically; this is attributed to the fact that BotNet attack was using the Tor network to attack their target leading to a fivefold increase.

In this paper, we study the problem of traffic analysis attacks in wireless body area sensor networks. When these networks are used in health-care for remote patient monitoring, traffic analysis can reveal the type of medical sensors mounted on the patient, and this information may be used to infer the patient's health problems. We show that simple signal processing methods can be used effectively for performing traffic analysis attacks and identifying the sensor types in a rather weak adversary model. We then investigate possible traffic obfuscation mechanisms aiming at hiding the regular patterns in the observable wireless traffic. Among the investigated countermeasures, traffic shaping, a mechanism that introduces carefully chosen delays for message transmissions, appears to be the best choice, as it achieves close to optimal protection and incurs no overhead.

Despite increasing popularity of anonymous communications, current anonymity networks are still vulnerable to traffic analysis attacks. We propose Homomorphic EnCrypTion enabled Onion Routing (HECTor) to defeat existing traffic analysis attacks. Instead of mixing traffic at the packet level as current anonymity networks, HECTor mixes traffic at the bit level with network coding techniques. In HECTor, homomorphic encryption enables onion-like layered encryption which has been proven successful in existing anonymity networks. We theoretically analyze the performance of HECTor. Our extensive experiments on HECTor show that HECTor can effectively mitigate existing traffic analysis attacks with high throughput.

The capability that a server can hide its location while offering various kinds of services to its clients is called hidden services or location-hiding. Almost previous low-latency anonymous communication systems such as Tor, MorphMix, etc. that can be used to implement hidden services are vulnerable against end-to-end traffic analysis attack. In this paper, we introduce a novel architecture for implementing hidden services which is robust against end-to-end traffic analysis attack. Moreover, our scheme is more robust against various traffic analysis attacks than previous low-latency anonymous communication architectures.KeywordsOverlay NetworkMalicious NodeClockwise DirectionResponse PacketRendezvous PointThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

The Tor network is one of the largest deployed anonymity networks, consisting of 1500+ volunteer-run relays and probably hundreds of thousands of clients connecting every day. Its large user-base has made it attractive for researchers to analyze usage of a real deployed anonymity network. The recent growth of the network has also led to performance problems, as well as attempts by some governments to block access to the Tor network. Investigating these performance problems and learning about network blocking is best done by measuring usage data of the Tor network. However, analyzing a live anonymity system must be performed with great care, so that the users’ privacy is not put at risk. In this paper we present a case study of measuring two different types of sensitive data in the Tor network: countries of connecting clients, and exiting traffic by port. Based on these examples we derive general guidelines for safely measuring potentially sensitive data, both in the Tor network and in other anonymity networks.

In many regions of the world, nation-states enforce Internet censorship policies that prevent unrestricted access to information and services by their citizens. Over the years, many censorship circumvention tools have been proposed which, however, require either the deployment of a dedicated infrastructure within trusted ISPs, or are vulnerable to state-of-the-art traffic analysis techniques. To fill this gap, we propose to build a practical censorship-circumvention service that exhibits strong resistance against traffic analysis attacks. By relying on a recent proposal for creating covert channels through WebRTC streams, we discuss the design of a distributed system named Censorship-Resistant Overlay Network (CRON). CRON aims at offering to the users located in censored regions a set of services that allow them to locate proxies positioned in the free Internet region, and set up secure covert tunnels for accessing arbitrary sites on the Internet. We present the key challenges and explore the solutions in making CRON robust against state-level attacks.

We present a novel web page fingerprinting attack that is able to defeat several recently proposed defenses against traffic analysis attacks, including the application-level defenses HTTPOS and randomized pipelining over Tor. Regardless of the defense scheme, our attack was able to guess which of 100 web pages a victim was visiting at least 50% of the time and, with some defenses, over 90% of the time. Our attack is based on a simple model of network behavior and out-performs previously proposed ad hoc attacks. We then build a web site fingerprinting attack that is able to identify whether a victim is visiting a particular web site with over 90% accuracy in our experiments.Our results strongly suggest that ad hoc defenses against traffic analysis are not likely to succeed. Consequently, we describe a defense scheme that provides provable security properties, albeit with potentially higher overheads.

Virtualization is the cornerstone of the developing third party compute industry, allowing cloud providers to instantiate multiple virtual machines (VMs) on a single set of physical resources. Customers utilize cloud resources alongside unknown and untrusted parties, creating the co-resident threat -- unless perfect isolation is provided by the virtual hypervisor, there exists the possibility for unauthorized access to sensitive customer information through the exploitation of covert side channels.

The development of digital media, the increasing use of social networks, the easier access to modern technological devices, is perturbing thousands of people in their public and private lives. People love posting their personal news without consider the risks involved. Privacy has never been more important. Privacy enhancing technologies research have attracted considerable international attention after the recent news against users personal data protection in social media websites like Facebook. It has been demonstrated that even when using an anonymous communication system, it is possible to reveal user’s identities through intersection attacks or traffic analysis attacks. Combining a traffic analysis attack with Analysis Social Networks (SNA) techniques, an adversary can be able to obtain important data from the whole network, topological network structure, subset of social data, revealing communities and its interactions. The aim of this work is to demonstrate how intersection attacks can disclose structural properties and significant details from an anonymous social network composed of a university community.

Users' anonymity and privacy are among the major concerns of today's Internet. Anonymizing networks are then poised to become an important service to support anonymous-driven Internet communications and consequently enhance users' privacy protection. Indeed, Tor an example of anonymizing networks based on onion routing concept attracts more and more volunteers, and is now popular among dozens of thousands of Internet users. Surprisingly, very few researches shed light on such an anonymizing network. Beyond providing global statistics on the typical usage of Tor in the wild, we show that Tor is actually being is-used, as most of the observed traffic belongs to P2P applications. In particular, we quantify the BitTorrent traffic and show that the load of the latter on the Tor network is underestimated because of encrypted BitTorrent traffic (that can go unnoticed). Furthermore, this paper provides a deep analysis of both the HTTP and BitTorrent protocols giving a complete overview of their usage. We do not only report such usage in terms of traffic size and number of connections but also depict how users behave on top of Tor. We also show that Tor usage is now diverted from the onion routing concept and that Tor exit nodes are frequently used as 1-hop SOCKS proxies, through a so-called tunneling technique. We provide an efficient method allowing an exit node to detect such an abnormal usage. Finally, we report our experience in effectively crawling bridge nodes, supposedly revealed sparingly in Tor.

Anonymity networks, also referred to as anonymous networks or darknets are an example of privacy-enhancing technology, the historical goal of which is to avoid censorship, preserve user privacy, and promote freedom of speech. The Tor network, undoubtedly the most popular anonymization technology at the time of this writing, according to its website, has several categories of users: individuals who wish to safeguard their online activity, businesses wanting to keep data confidential or conducting competitive analysis, journalists willing to protect anonymous sources and sensitive research, and activists who want to report abuses from danger zones.

In the Tor anonymity network, the distribution of topology information relies on the correct behavior of five out of the nine trusted directory authority servers. This centralization is concerning since a powerful adversary might compromise these servers and conceal information about honest nodes, leading to the full de-anonymization of all Tor users. Our work aims at distributing the work of these trusted authorities, such increasing resilience against attacks on core infrastructure components of the Tor network. In particular, we leverage several emerging technologies, such as blockchains, smart contracts, and trusted execution environments to design and prototype a system called SmarTor. This system replaces the directory authorities with a smart contract and a distributed network of untrusted entities responsible for bandwidth measurements. We prototyped SmarTor using Ethereum smart contracts and Intel SGX secure hardware. In our evaluation, we show that SmarTor produces significantly more reliable and precise measurements compared to the current measurement system. Overall, our solution improves the decentralization of the Tor network, reduces trust assumptions and increases resilience against powerful adversaries like law enforcement and intelligence services.

Threat modeling is a critical proactive security technique for identifying threats and determining mitigations. However, traditional approaches often fall short for Industrial Control Systems (ICS), which automate operations in domains like manufacturing and energy and are a subset of Cyber-Physical Systems (CPS). CPS integrates computation, networking, and physical processes, with ICS requiring specialized cybersecurity approaches due to its operational and safety-critical nature. This study explores the use of digital twin technology as a promising cybersecurity tool for ICS, enabling testing and analysis without disrupting operations. By examining the capabilities of digital twins in analysis, simulation, and replication, the research evaluates their potential to enhance threat modeling across the CPS life-cycle. Insights from the European Cyber Security Organisation (ECSO) Technical Paper on Cybersecurity Scenarios and Digital Twins guide the exploration of their role in threat modeling. The study addresses four research questions: 1. What purposes do digital twins serve in cybersecurity? 2. What benefits do digital twins offer in cybersecurity? 3. How can digital twin technology be leveraged for threat modeling? 4. What advantages can the use of digital twins bring to threat modeling? Our findings reveal that digital twins enhance ICS threat modeling by enabling continuous, dynamic, and autonomous assessment, offering valuable insights for advancing cybersecurity strategies in ICS, CPS, and related domains.