Tor Traffic Classification Based on Burst Features

The classification of Tor traffic is of crucial importance in the identification of anonymous web applications and the defense against cybercrime. Previous studies have focused on the automatic extraction of raw traffic features by means of deep learning algorithms. However, these methods have neglected the global intrinsic relationship between local features at different data locations, which has resulted in limited classification performance. In this regard, a dark net traffic classification method based on burst feature aggregation, called burst matrix, is proposed. The proposed method involves the aggregation of temporal and length features of Tor traffic in terms of bursts, followed by the capture of local spatio-temporal features from the burst matrix using convolutional neural networks. The intrinsic relationships and hidden connections between the previously extracted spatio-temporal features are then mined using the self-attention mechanism. The efficacy of the burst matrix method is then evaluated using the ISCXTor2016 dataset. The experimental results demonstrate that the burst matrix significantly outperforms other contemporary methods, attaining an F1-score of over 95 .