Tor Entry Research Articles

SMART: A Lightweight and Reliable Multi-Path Transmission Model against Website Fingerprinting Attacks

The rapid development of IoT technology has promoted the integration of physical space and cyberspace. At the same time, it has also increased the risk of privacy leakage of Internet users. A large number of research works have shown that attackers can infer Internet surfing privacy through traffic patterns without decryption. Most of the existing research work on anti-traffic analysis is based on a weakened experimental assumption, which is difficult to apply in the actual IoT network environment and seriously affects the user experience. This article proposes a novel lightweight and reliable defense—SMART, which can ensure the anonymity and security of network communication without sacrificing network transmission performance. SMART introduces a multi-path transmission model in the Tor network, and divides traffic at multiple Tor entry onion relays, preventing attackers from obtaining network traffic statistical characteristics. We theoretically proved that SMART can improve the uncertainty of website fingerprint analysis results. The experimental result shows that SMART is able to resist encrypted traffic analysis tools, reducing the accuracy of four state-of-the-art classifiers from 98% to less than 12%, without inducing any additional artificial delay or dummy traffic. In order to avoid the performance degradation caused by data reassembly, SMART proposes a redundant slice mechanism to ensure reliability. Even in the case of human interference, the communication success rate is still as high as 97%.

Anonymizing communication flow identifiers in the Internet of Things

We tackle the problem of privacy breaching in IPv6 over Low-Power Wireless Personal Area Networks (6LoWPANs) where an attacker may be able to identify the communicating entities. We propose a solution based on: (i) anonymizing both IP and MAC addresses, as well as port number at the source host, using a random pseudonyming scheme, and (ii) anonymizing the IP address and port number of the destination host, using a Tor-like network. We analyzed the effect of the Tor entry node location on the performance of our solution in three different scenarios: the Tor entry node is located (i) inside the 6LoWPAN, (ii) at the IPv6 Low-power Border Router (6LBR), or (iii) completely outside the 6LoWPAN. Using Cooja simulator, we showed that our solution outperforms state-of-the-art solutions by making it more difficult to identify communication flows by improving the anonymity and unlinkability of the communicating entities without significantly affecting energy consumption, communication delay, and network bandwidth.

The Challenge of Only One Flow Problem for Traffic Classification in Identity Obfuscation Environments

As encrypted traffic grows, network flow classification has become a significant issue because of the impossibility to parse the payload in an encrypted packet. A possible packet sniffing location for organizations is an under control gateway between intranet and internet to inspect network traffic. However, when an intranet user uses an identity obfuscation protocol such as VPN or TOR, the packet IP and port would be rewritten to preserve user privacy. The same user's packet sniffed between a user and TOR entry node/VPN proxy always has the same 5-tuples (packets with the same source IP, destination IP, source port, destination port, and IP protocol defined as flow). Thus, we cannot rely on the 5-tuples rule to split traffic into flows. This challenge is called the “only one flow problem” and poses an obstacle for flow classification. A previous solution uses timeout value to determine flow separation points to address this issue. However, the predefined static time threshold cannot fit all user habits, which leads to separation errors. To overcome timeout limitations, we propose a flexible method called AI-FlowDet by leveraging the scene change concept and a CNN model to find behavior change points of traffic based on learning data. AI-FlowDet can apply to the traffic of the identity obfuscation protocols. Next, we propose 294 size-based and direction-based features that can be used with AI-FlowDet to evaluate flow type classification performance. Every experiment leverages different machine learning algorithms. The results show that AI-FlowDet with the proposed features can achieve 98.5% weighted accuracy, which is increased by 12.6% versus the previous timeout method with baseline features. We proved that the proposed splitting methods for the only one flow problem and proposed features for flow type classification are effective based on the good results obtained for both the VPN and TOR datasets.

The potential harms of the Tor anonymity network cluster disproportionately in free countries

The Tor anonymity network allows users to protect their privacy and circumvent censorship restrictions but also shields those distributing child abuse content, selling or buying illicit drugs, or sharing malware online. Using data collected from Tor entry nodes, we provide an estimation of the proportion of Tor network users that likely employ the network in putatively good or bad ways. Overall, on an average country/day, ∼6.7% of Tor network users connect to Onion/Hidden Services that are disproportionately used for illicit purposes. We also show that the likely balance of beneficial and malicious use of Tor is unevenly spread globally and systematically varies based upon a country's political conditions. In particular, using Freedom House's coding and terminological classifications, the proportion of often illicit Onion/Hidden Services use is more prevalent (∼7.8%) in "free" countries than in either "partially free" (∼6.7%) or "not free" regimes (∼4.8%).

DPSelect: A Differential Privacy Based Guard Relay Selection Algorithm for Tor

Abstract Recent work has shown that Tor is vulnerable to attacks that manipulate inter-domain routing to compromise user privacy. Proposed solutions such as Counter-RAPTOR [29] attempt to ameliorate this issue by favoring Tor entry relays that have high resilience to these attacks. However, because these defenses bias Tor path selection on the identity of the client, they invariably leak probabilistic information about client identities. In this work, we make the following contributions. First, we identify a novel means to quantify privacy leakage in guard selection algorithms using the metric of Max-Divergence. Max-Divergence ensures that probabilistic privacy loss is within strict bounds while also providing composability over time. Second, we utilize Max-Divergence and multiple notions of entropy to understand privacy loss in the worst-case for Counter-RAPTOR. Our worst-case analysis provides a fresh perspective to the field, as prior work such as Counter-RAPTOR only analyzed average case-privacy loss. Third, we propose modifications to Counter-RAPTOR that incorporate worst-case Max-Divergence in its design. Specifically, we utilize the exponential mechanism (a mechanism for differential privacy) to guarantee a worst-case bound on Max-Divergence/privacy loss. For the quality function used in the exponential mechanism, we show that a Monte-Carlo sampling-based method for stochastic optimization can be used to improve multi-dimensional trade-offs between security, privacy, and performance. Finally, we demonstrate that compared to Counter-RAPTOR, our approach achieves an 83% decrease in Max-Divergence after one guard selection and a 245% increase in worst-case Shannon entropy after 5 guard selections. Notably, experimental evaluations using the Shadow emulator shows that our approach provides these privacy benefits with minimal impact on system performance.

TorWard: Discovery, Blocking, and Traceback of Malicious Traffic Over Tor

Tor is a popular low-latency anonymous communication system. It is, however, currently abused in various ways. Tor exit routers are frequently troubled by administrative and legal complaints. To gain an insight into such abuse, we designed and implemented a novel system, TorWard, for the discovery and the systematic study of malicious traffic over Tor. The system can avoid legal and administrative complaints, and allows the investigation to be performed in a sensitive environment such as a university campus. An intrusion detection system (IDS) is used to discover and classify malicious traffic. We performed comprehensive analysis and extensive real-world experiments to validate the feasibility and the effectiveness of TorWard. Our results show that around 10% Tor traffic can trigger IDS alerts. Malicious traffic includes P2P traffic, malware traffic (e.g., botnet traffic), denial-of-service attack traffic, spam, and others. Around 200 known malwares have been identified. To mitigate the abuse of Tor, we implemented a defense system, which processes IDS alerts, tears down, and blocks suspect connections. To facilitate forensic traceback of malicious traffic, we implemented a dual-tone multi-frequency signaling-based approach to correlate botnet traffic at Tor entry routers and that at exit routers. We carried out theoretical analysis and extensive real-world experiments to validate the feasibility and the effectiveness of TorWard for discovery, blocking, and traceback of malicious traffic.

Actual rejection levels in a certain stepwise test

Continuing me work of Draper, Guttman and Kanemasu (1971) we obtain the appropriate distribution and evaluate some actual probability levels tor entry of variables in stepwise regression when the denominator of the F-statistic is a biased estimate of the residual variance and there are two possible entry candidates.