Meek-Based Tor Traffic Identification with Hidden Markov Model

Abstract

Tor is one of the major technologies of censorship circumvention systems. To protect the privacy of users and the information of first hop to access Tor networks, Tor Browser introduces an obfuscation technology called Meek. Tor traffic is obfuscated by Meek to behave as ordinary cloud service traffic. In order to advance the capability of network monitoring systems, this paper proposes a Mixture of Gaussians based Hidden Markov Model (MGHMM), a new model for identifying Meek-based Tor traffic. The proposed MGHMM has two components: 1) Mixture of Gaussians (MOG) is used to characterize the Inter-Packet Time (IPT) distribution and the Packet Size (PS) density distribution; 2) HMM is used to compute the probability of a traffic observation sequence and identify Meek-based Tor traffic by using two-dimensional observations composed by IPT and PS. The effectiveness of the proposed model is evaluated with real-world traffic. Extensive experiments show that the proposed MGHMM is able to identify Meek-based Tor traffic effectively.