Meek-Based Tor Traffic Identification with Hidden Markov Model
2018 IEEE 20th International Conference on High Performance Computing and Communications; IEEE 16th International Conference on Smart City; IEEE 4th International Conference on Data Science and Systems (HPCC/SmartCity/DSS)(2018)
Abstract
Tor is one of the major technologies of censorship circumvention systems. To protect the privacy of users and the information of first hop to access Tor networks, Tor Browser introduces an obfuscation technology called Meek. Tor traffic is obfuscated by Meek to behave as ordinary cloud service traffic. In order to advance the capability of network monitoring systems, this paper proposes a Mixture of Gaussians based Hidden Markov Model (MGHMM), a new model for identifying Meek-based Tor traffic. The proposed MGHMM has two components: 1) Mixture of Gaussians (MOG) is used to characterize the Inter-Packet Time (IPT) distribution and the Packet Size (PS) density distribution; 2) HMM is used to compute the probability of a traffic observation sequence and identify Meek-based Tor traffic by using two-dimensional observations composed by IPT and PS. The effectiveness of the proposed model is evaluated with real-world traffic. Extensive experiments show that the proposed MGHMM is able to identify Meek-based Tor traffic effectively.
MoreTranslated text
Key words
Tor, Meek, Traffic Identification, Mixture of Gaussians, Hidden Markov Model
AI Read Science
Must-Reading Tree
Example
![](https://originalfileserver.aminer.cn/sys/aminer/pubs/mrt_preview.jpeg)
Generate MRT to find the research sequence of this paper
Chat Paper
Summary is being generated by the instructions you defined