Source-linked AI summary
DeepCorr: Strong Flow Correlation Attacks on Tor Using Deep Learning
Milad Nasr, Alireza Bahramali, Amir Houmansadr
TL;DR
Existing Tor flow-correlation techniques were considered unreliable at scale because Tor’s noisy network perturbs traffic features and forces long observations. DeepCorr learns a Tor-tailored correlation function with deep learning and, in large-scale live-Tor experiments, substantially outperformed prior methods using shorter observations. The results highlight escalating flow-correlation risks and the need for effective countermeasures.
Problem
Existing algorithms were considered ineffective for reliably linking Tor connections at scale because Tor introduces large jitter, fragmentation, and repacketization that disrupt traffic-feature correlation.
Method
DeepCorr uses an advanced deep learning architecture trained on associated and non-associated Tor flow pairs to learn a correlation function tailored to Tor’s complex network.
Results
96% correlation accuracy versus RAPTOR’s 4% was achieved with 900 packets from each intercepted flow, while DeepCorr also reached a 0.8 true positive rate with 300 packets at a 10^-3 false positive rate.
Takeaways & Limitations
DeepCorr demonstrates that advanced learning algorithms can substantially strengthen Tor flow-correlation attacks and motivates effective traffic-obfuscation countermeasures.
Takeaways & Limitations
Resisting DeepCorr with obfuscation remains difficult because stronger protection such as obfs4 with IAT=1 increases bandwidth and CPU costs and reduces quality of service.
Abstract
from arXiv · showhide
Flow correlation is the core technique used in a multitude of deanonymization attacks on Tor. Despite the importance of flow correlation attacks on Tor, existing flow correlation techniques are considered to be ineffective and unreliable in linking Tor flows when applied at a large scale, i.e., they impose high rates of false positive error rates or require impractically long flow observations to be able to make reliable correlations. In this paper, we show that, unfortunately, flow correlation attacks can be conducted on Tor traffic with drastically higher accuracies than before by leveraging emerging learning mechanisms. We particularly design a system, called DeepCorr, that outperforms the state-of-the-art by significant margins in correlating Tor connections. DeepCorr leverages an advanced deep learning architecture to learn a flow correlation function tailored to Tor's complex network this is in contrast to previous works' use of generic statistical correlation metrics to correlated Tor flows. We show that with moderate learning, DeepCorr can correlate Tor connections (and therefore break its anonymity) with accuracies significantly higher than existing algorithms, and using substantially shorter lengths of flow observations. For instance, by collecting only about 900 packets of each target Tor flow (roughly 900KB of Tor data), DeepCorr provides a flow correlation accuracy of 96% compared to 4% by the state-of-the-art system of RAPTOR using the same exact setting. We hope that our work demonstrates the escalating threat of flow correlation attacks on Tor given recent advances in learning algorithms, calling for the timely deployment of effective countermeasures by the Tor community.
1 INTRODUCTION
Tor’s low-latency design leaves packet timings and sizes largely unobfuscated, making flow correlation central to many attacks despite substantial network noise. DeepCorr uses deep learning tailored to Tor to correlate short-observation flows more accurately and quickly than prior methods.
- Tor and Flow Correlation: Tor carries traffic through onion-circuits to conceal communicating parties’ IP-address association and serves more than 2 million daily users.Its network includes around 7,000 public relays and carries terabytes of traffic daily.
- Tor and Flow Correlation: Low-latency Tor relays avoid obfuscating packet timings, making Tor susceptible to flow correlation attacks.Some bridges, but not public relays, use pluggable transports to obfuscate traffic characteristics.
- Tor and Flow Correlation: Flow correlation links ingress and egress segments by comparing traffic characteristics, especially packet timings and packet sizes, and supports a wide spectrum of Tor attacks.Prior attacks increase an adversary’s chances of observing both ends through guard placement, denial of service, or routing manipulation.
- The Challenge: Tor’s congestion-induced jitter, fragmentation, and repacketization make reliable large-scale correlation difficult for existing algorithms.These perturbations make traffic features across associated ingress and egress flows difficult to correlate unless observations are very large.
- DeepCorr: DeepCorr learns a Tor-tailored correlation function with deep learning instead of applying generic statistical correlation metrics.It can link flows on arbitrary circuits and destinations, including destinations absent from training data.
- DeepCorr: 96% accuracy versus RAPTOR’s 4% was achieved using 900 packets from each intercepted flow.In another setting, DeepCorr reached a true positive rate of 0.8 with 300 packets versus less than 0.05 by prior work at a 10^-3 false positive rate; correlation took 2ms versus RAPTOR’s more than 20ms at 95% target accuracy.
- Generality and Countermeasures: DeepCorr’s performance remains consistent across test datasets with different sizes and circuits, and it can also correlate flows in other applications.The system was additionally applied to stepping-stone detection in unreliable network settings.
- Generality and Countermeasures: Meek and obfs4-iat0 provide little protection against DeepCorr, whereas obfs4-iat1 provides better protection but is not widely deployed.The paper calls for effective obfuscation mechanisms that avoid large bandwidth and performance overheads.
2 PRELIMINARIES AND MOTIVATION
Flow correlation links ingress and egress Tor flows using traffic characteristics despite encryption, but Tor’s noisy network makes reliable large-scale correlation difficult. This paper introduces DeepCorr, which learns a Tor-tailored correlation function and evaluates it against prior techniques and countermeasures.
- Flow Correlation Setting: Flow correlation links associated ingress and egress flows by comparing traffic characteristics such as packet timings and sizes, which remain observable despite encrypted contents.In Tor, associated flows are entry and exit segments of the same connection, but onion encryption prevents linking them through packet contents.
- Threat Model: An adversary can intercept Tor flows by operating malicious relays or wiretapping autonomous systems and Internet exchange points.These locations provide access to traffic features from entering and exiting Tor flows.
- Related Topics Out of Our Scope: The paper studies passive flow correlation only; active flow watermarking and website fingerprinting use different threat models and are outside its scope.Passive attacks are described as information theoretically undetectable, whereas watermarking manipulates traffic features and may reveal the adversary.
- Existing Techniques: Existing correlation methods use statistical metrics such as mutual information, Pearson correlation, cosine similarity, and Spearman correlation to compare flow features.RAPTOR uses Spearman correlation for Tor-flow correlation.
- Motivation: Tor’s network jitter, congestion, fragmentation, and repacketization perturb associated flows, making reliable correlation difficult at scale.Prior techniques require very large observations and unrealistically small target-flow sets; one state-of-the-art method requires 100MB per flow for about five minutes.
- This Paper’s Contributions: DeepCorr uses deep learning to learn a correlation function tailored to Tor’s complex noise instead of relying on generic statistical correlation algorithms.The system cross-correlates live Tor connections and is evaluated through large-scale experiments against prior techniques and existing countermeasures.
3 INTRODUCING DeepCorr
DeepCorr learns a Tor-specific flow-correlation function from raw timing and size features, then classifies flow pairs as associated or non-associated. Its CNN architecture processes paired flows and outputs a correlation probability used with a detection threshold.
- DeepCorr uses deep learning to learn correlation functions for Tor flow pairs.
- Features and Their Representation: Each bidirectional flow is represented using upstream and downstream inter-packet delays and packet sizes, truncated or zero-padded to length ℓ.
- Features and Their Representation: A flow pair is formed as an eight-row array whose lines are taken from the two individual flow representations.
- Network Architecture: The CNN uses two convolutional layers followed by three fully connected layers to capture adjacent and combined timing-size traffic features.Max pooling follows each convolutional layer to provide permutation invariance and help avoid overfitting.
- Network Architecture: The network outputs pi,j, a sigmoid-scaled probability that flows i and j are associated, and declares correlation when pi,j > η.The parameters (w1,w2,k1,k2) are tuned experimentally.
- Training: Training uses associated flow pairs labeled yi,j = 1 and arbitrary non-associated pairs labeled yi,j = 0.The loss is defined with cross-entropy, and Adam is used to minimize it.
- Training: CNNs provided the best flow-correlation performance among the investigated learning algorithms, while fully connected networks achieved accuracy 0.4.
4 EXPERIMENTAL SETUP
The experiments collect Tor ingress and egress traffic from large-scale web browsing, train and test on separate connections, and evaluate correlation using TP, FP, ROC curves, and RAPTOR-style accuracy. Hyperparameters are selected through empirical trials on the collected data.
- Data Collection: The setup browses the top 50,000 Alexa websites over Tor using separate virtual machines and divides connections between training and testing.Ingress flows are in Tor cell format, while egress flows use regular HTTP/HTTPS format.
- Data Collection: Ingress traffic is captured on Tor clients, while egress traffic is collected through an owned SOCKS proxy server.The proxy may add latency to collected flows.
- Data Collection: The study evaluates pluggable transports using a smaller flow set because Tor bridges are scarce and expensive.
- Data Collection: Traffic is collected over two periods separated by a three-month gap, and the resulting correlated-flow dataset is made publicly available.
- Choosing the Hyperparameters: Hyperparameters are optimized by trying alternative learning rates, negative-sample counts, convolution window sizes, pooling sizes, and kernel counts.The network takes about a day to converge for each parameter optimization using one Nvidia TITAN X GPU.
- Evaluation Metrics: True-positive and false-positive rates are the main evaluation metrics, with ROC curves used to compare threshold trade-offs.
- Evaluation Metrics: RAPTOR comparisons additionally use accuracy under a one-to-one flow-association rule, while other experiments allow arbitrary numbers of intercepted-flow matches.
5 EXPERIMENT RESULTS
DeepCorr shows strong Tor-flow correlation using short observations and remains effective across circuits and destinations unlike destination- or circuit-specific learning requirements.
- For a false-positive rate of 10^-3, DeepCorr achieves a true-positive rate close to 0.8 using only 300 packets per flow.Shorter flows are padded to 300 packets when necessary, and the detection threshold trades off true-positive and false-positive rates.
- DeepCorr performs similarly when tested on the same or different circuits and destinations, including flows collected one week after training.The learned correlation function is intended for arbitrary circuits and destinations rather than memorized targets.
- A three-month gap between training and testing produces degraded performance compared with shorter or absent gaps.The three-month condition is evaluated as an older-model case in the same comparison.
5.3 DeepCorr Does Not Need to Re-Train Frequently
DeepCorr remains stable across changing test conditions without frequent retraining, but its associated-flow scores begin to decline after about three weeks and degrade substantially after three months.
- After about three weeks without retraining, correlation values for associated flows begin to slightly degrade while non-associated-flow values remain largely stable.The 30-day evaluation tracks both associated and non-associated pairs.
- DeepCorr may require retraining only every three weeks or even once a month to preserve correlation performance.This estimate follows the observed gradual degradation during the 30-day evaluation.
- Three months between training and testing significantly degrades accuracy, although the degraded performance remains superior to prior techniques compared in Figure 10.The three-month result represents an extreme lack-of-retraining condition.
5.4 DeepCorr’s Performance Does Not Degrade with the Number of Test Flows
DeepCorr’s correlation performance is consistent across testing datasets of different sizes, while longer flow observations substantially improve detection performance at a cost in adversarial overhead.
- DeepCorr’s true-positive and false-positive results remain consistent across testing datasets with different numbers of flows.The evaluation uses a fixed threshold and suggests similar performance on substantially larger intercepted-flow datasets.
- At a false-positive rate of 10^-3, true-positive rate rises from 0.62 with 100-packet flows to 0.95 with 450-packet flows.The comparison demonstrates rapid improvement as training and testing flows become longer.
- Longer intercepted flows improve correlation but increase storage, computation, and real-time detection waiting costs for the adversary.Flow length therefore creates a performance-versus-overhead tradeoff.
5.6 DeepCorr’s Performance Improves with the Size of the Training Set
DeepCorr’s correlation performance improves with more training flows. Larger training sets raise detection performance, though they increase training time.
- TP rises from 0.56 to 0.8 at FP = 10^-3 when training flows increase from 1,000 to 5,000.Both settings use 1,000 flows for testing.
- DeepCorr’s ROC performance improves as the training set grows.Figure 9 compares models trained with different numbers of flows while holding the test set at 1,000 flows.
- DeepCorr significantly outperforms prior flow-correlation algorithms on identical Tor-flow datasets.With flows of at most 300 packets, DeepCorr achieves TP = 0.8 at FP = 10^-3, while previous systems remain below TP = 0.05.
- Longer flow observations improve correlation performance, but DeepCorr retains a substantially wider advantage over RAPTOR for shorter observations.Prior RAPTOR experiments used 100MB flows, whereas the described DeepCorr experiments used 300 packets, approximately 300KB.
5.8 DeepCorr’s Computational Complexity
DeepCorr requires more computation per correlation than prior techniques and includes a substantial training phase. Despite this overhead, it delivers much stronger correlation performance at comparable flow lengths.
- Figures 10–13 compare DeepCorr with prior systems and RAPTOR across matched flow lengths, data volumes, and short-flow settings.Figure 14 presents DeepCorr’s stepping-stone attack architecture rather than a computational-complexity comparison.
- DeepCorr is roughly two times slower than RAPTOR for a single correlation.All systems process flows containing 300 packets.
- DeepCorr achieves TP≈0.9 while previous systems provide TP less than 0.2 under the same flow-length setting.The comparison is based on Figure 10 with 300-packet flows.
- DeepCorr is trained on about 25,000 associated and approximately 6.2 × 10^8 non-associated flow pairs.Training uses 300-packet flows and a standard Nvidia TITAN X GPU.
- Training DeepCorr takes roughly one day on a single TITAN X GPU.The system does not need to be retrained frequently.
5.9 DeepCorr Works in Non-Tor Applications as Well
DeepCorr also applies beyond Tor flow correlation. In stepping-stone experiments, it matches optimal techniques under stable conditions and performs better under noisy conditions.
- The stepping-stone application uses a simpler neural network because its noise model is simpler than Tor’s.DeepCorr is retrained specifically for the stepping-stone setting.
- DeepCorr provides performance comparable to optimal flow-correlation techniques when network conditions are stable.The stepping-stone experiments use CAIDA traces with simulated jitter and packet drops.
- DeepCorr significantly outperforms state-of-the-art stepping-stone detectors when network conditions are noisy.Figure 15 uses 0.005-second jitter standard deviation and a 1% packet-drop rate.
6 COUNTERMEASURES
The paper discusses traffic obfuscation and relay-selection changes as countermeasures against flow correlation. Both approaches involve deployment or performance trade-offs.
- 6.1 Obfuscate Traffic Patterns: Traffic obfuscation modifies packet timings and sizes to counter flow-correlation attacks.Suggested mechanisms include padding, splitting, and Tor pluggable transports.
- 6.1 Obfuscate Traffic Patterns: Pluggable transports currently obfuscate traffic between censored clients and their first Tor relay, not across public relays.They are therefore not deployed by Tor’s public relays.
- 6.1 Obfuscate Traffic Patterns: The authors suggest public relays deploy obfuscation such as obfs4 with IAT=1 against DeepCorr.Their bridge experiments used 500 websites and small training sets for ethical reasons, making the reported correlation results optimistic.
- 6.1 Obfuscate Traffic Patterns: Obfuscation can increase cost, bandwidth and CPU overhead, and reduce quality of service.Designing a mechanism balancing performance, cost, and anonymity remains open.
- 6.2 Relay Selection: AS-aware relay-selection mechanisms aim to reduce malicious AS interception of both ends of Tor connections.None of the proposed alternatives had been deployed because of negative performance, cost, and privacy impacts.
7 CONCLUSIONS
DeepCorr substantially strengthens Tor flow correlation by using deep learning tailored to the network’s complex behavior. It achieves higher accuracy with shorter flow observations than existing algorithms, highlighting the need for effective countermeasures.
- DeepCorr uses an advanced deep learning architecture to learn a flow correlation function tailored to Tor’s complex network.
- DeepCorr drastically outperforms state-of-the-art systems in correlating Tor connections.
- DeepCorr correlates Tor connections with significantly higher accuracy than existing algorithms using substantially shorter flow observations.