Study of semi-supervised learning based encrypted traffic classification method for Tor anonymity network

CAO Qingwei; GONG Liangyi; LI Yufu; MO Xiuliang; YANG Ke; YUAN Yali

doi:10.11959/j.issn.2096-109x.2025070

您当前的位置：

首页 >

文章列表页 >

Study of semi-supervised learning based encrypted traffic classification method for Tor anonymity network

Papers | 更新时间：2026-01-28

- Study of semi-supervised learning based encrypted traffic classification method for Tor anonymity network
- Chinese Journal of Network and Information Security Vol. 11, Issue 6, Pages: 131-143(2025)
- 作者机构：
  
  1.天津理工大学，天津 300384
  2.中国科学院计算机网络信息中心，北京 100083
  3.中国科学院大学，北京 101408
  4.东南大学，江苏南京 211189
- 作者简介：
- 基金信息：
  
  The National Key Research and Development Program of China(2023YFB3106700)
- DOI：10.11959/j.issn.2096-109x.2025070
  CLC： TP393
- Received：28 April 2025，
  
  Revised：2024-06-17，
  
  Published：25 December 2025
- 稿件说明：
移动端阅览
曹庆伟, 宫良一, 李雨芙, 等. 基于半监督学习的Tor匿名网络加密流量分类方法研究[J]. 网络与信息安全学报, 2025, 11(6): 131-143.

CAO Qingwei, GONG Liangyi, LI Yufu, et al. Study of semi-supervised learning based encrypted traffic classification method for Tor anonymity network[J]. Chinese Journal of Network and Information Security, 2025, 11(6): 131-143.
曹庆伟, 宫良一, 李雨芙, 等. 基于半监督学习的Tor匿名网络加密流量分类方法研究[J]. 网络与信息安全学报, 2025, 11(6): 131-143. DOI： 10.11959/j.issn.2096-109x.2025070.

CAO Qingwei, GONG Liangyi, LI Yufu, et al. Study of semi-supervised learning based encrypted traffic classification method for Tor anonymity network[J]. Chinese Journal of Network and Information Security, 2025, 11(6): 131-143. DOI： 10.11959/j.issn.2096-109x.2025070.

摘要

Tor（the onion routing）匿名网络的多层加密和动态中继机制，给流量分类带来了巨大挑战。传统流量识别技术难以有效检测Tor匿名网络流量中的非法应用或网站流量。针对这一问题提出一种基于半监督学习的Tor匿名网络加密流量分类方法。该方法采用“预训练+微调”的统一框架，通过充分挖掘无标签数据的价值提升分类效能。在预训练阶段，设计了动态掩码机制，通过逐步调整掩蔽比例增强模型的特征学习能力；在微调阶段，引入通道与空间注意力（channel and spatial attention

CSA）模块，提升模型对局部关键区域的感知精度。该方法以Transformer为基础架构，兼具自监督特征提取与判别能力增强能力。实验结果表明，在ISCXTor2016与自采暗网数据集上，所提方法在对8类典型流量进行分类时，各项性能指标均超过98%，展现出优异的泛化能力与应用价值。

Abstract

The onion routing (Tor) anonymous network

due to its multi-layer encryption and dynamic relay mechanisms

posed significant challenges for traffic classification. Illegal applications or websites traffic hidden within Tor anonymous network traffic could not be effectively detected by traditional traffic identification techniques. To address this issue a semi-supervised learning-based method for encrypted traffic classification in Tor networks was proposed. A unified "pretraining + fine-tuning" framework was utilized to fully leverage unlabeled data. In the pretraining phase

a dynamic masking mechanism was introduced to gradually adjust the masking ratio

enhancing the model’s ability to learn latent features. In the fine-tuning phase

a channel and spatial attention (CSA) module was integrated to improve the model’s sensitivity to critical local regions. The overall approach was built on a Transformer-based architecture

combining self-supervised feature extraction with enhanced discriminative capability. Experimental results on the ISCXTor2016 dataset and a self-collected dark web traffic dataset showed that the proposed method achieved over 98% across all performance metrics in classifying eight typical traffic categories

demonstrating excellent generalization ability and practical value.

关键词

Keywords

references

罗军舟 , 杨明 , 凌振 , 等 . 匿名通信与暗网研究综述 [J ] . 计算机研究与发展 , 2019 , 56 ( 1 ): 103 - 130 .

LUO J Z , YANG M , LING Z , et al . Anonymous communication and darknet: a survey [J ] . Journal of Computer Research and Development , 2019 , 56 ( 1 ): 103 - 130 .

翟明芳 , 张兴明 , 赵博 . 基于深度学习的加密恶意流量检测研究 [J ] . 网络与信息安全学报 , 2020 , 6 ( 3 ): 66 - 77 .

ZHAI M F , ZHANG X M , ZHAO B . Survey of encrypted malicious traffic detection based on deep learning [J ] . Chinese Journal of Network and Information Security , 2020 , 6 ( 3 ): 66 - 77 .

CHANG H W , ZHANG H , JIANG L , et al . MaskGIT: masked generative image Transformer [C ] // Proceedings of the 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) . Piscataway : IEEE Press , 2022 : 11305 - 11315 .

HU J , SHEN L , SUN G . Squeeze-and-excitation networks [C ] // Proceedings of the 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition . Piscataway : IEEE Press , 2018 : 7132 - 7141 .

KUHN C , HOFHEINZ D , RUPP A , et al . Onion routing with replies [C ] // Proceedings of the 27th International Conference on the Theory and Application of Cryptology and Information Security . Berlin : Springer , 2021 : 573 - 604 .

DINGLEDINE R , MATHEWSON N , SYVERSON P F . Tor: the second-generation onion router [C ] // Proceedings of the 13th USENIX Security Symposium . Berkeley : USENIX Association , 2004 : 303 - 320 .

ABDULLAH A M . Advanced encryption standard (AES) algorithm to encrypt and decrypt data [J ] . Cryptography and Network Security , 2017 , 16 ( 1 ): 11 .

HABIBI LASHKARI A , DRAPER GIL G , MAMUN M S I , et al . Characterization of tor traffic using time based features [C ] // Proceedings of the 3rd International Conference on Information Systems Security and Privacy . Porto ： SciTePress , 2017 : 253 - 262 .

CHOOROD P , WEIR G . Tor traffic classification based on encrypted payload characteristics [C ] // Proceedings of the 2021 National Computing Colleges Conference (NCCC) . Piscataway : IEEE Press , 2021 : 1 - 6 .

ILIADIS A L , KAIFAS T . Darknet traffic classification using machine learning techniques [C ] // Proceedings of the 10th International Conference on Modern Circuits and Systems Technologies . Piscataway : IEEE Press , 2021 : 1 - 4 .

LASHKARI A H , KAUR G , RAHALI A . DIDarknet: a contemporary approach to detect and characterize the darknet traffic using deep image learning [C ] // Proceedings of the 10th International Conference on Communication and Network Security . New York : ACM , 2020 : 1 - 13 .

KIRUBAVATHI G , AMITHESH Y . Detection and characterization of darknet traffic using attention LSTM with XAI [C ] // Proceedings of the 2024 International Conference on Intelligent Systems for Cybersecurity (ISCS) . Piscataway : IEEE Press , 2024 : 1 - 7 .

ZHU Y H , TAO J , WANG H T , et al . DGNN: accurate darknet application classification adopting attention graph neural network [J ] . IEEE Transactions on Network and Service Management , 2023 , 21 ( 2 ): 1660 - 1671 .

KINGMA D P , BA J , HAMMAD M M . Adam: a method for stochastic optimization [J ] . arXiv Preprint , arXiv: 1412.6980 , 2014 .

LIN X J , XIONG G , GOU G P , et al . ET-BERT: a contextualized datagram representation with pre-training Transformers for encrypted traffic classification [C ] // Proceedings of the ACM Web Conference 2022 . New York : ACM , 2022 : 633 - 642 .

BASSILY R , MORAN S , NANDI A . Learning from mixtures of private and public populations [J ] . Advances in Neural Information Processing Systems , 2020 , 33 : 2947 - 2957 .

ZHAO R J , ZHAN M W , DENG X W , et al . Yet another traffic classifier: a masked autoencoder based traffic Transformer with multi-level flow representation [C ] // Proceedings of the AAAI Conference on Artificial Intelligence WashingtonDC: AAAI Press , 2023 : 5420 - 5427 .

VASWANI A , SHAZEER N , PARMAR N , et al . Attention is all you need [C ] // Proceedings of the Advances in Neural Information Processing Systems . 2017 : 5998 - 6008 .

VAN-EDE T , BORTOLAMEOTTI R , CONTINELLA A , et al . FlowPrint: semi-supervised mobile-app fingerprinting on encrypted network traffic [C ] // Proceedings of the 27th Annual Network and Distributed System Security Symposium . Virginia : the Internet Society , 2020 .

TAYLOR V F , SPOLAOR R , CONTI M , et al . Robust smartphone app identification via encrypted network traffic analysis [J ] . IEEE Transactions on Information Forensics and Security , 2018 , 13 ( 1 ): 63 - 78 .

SIAMI-NAMINI S , TAVAKOLI N , NAMIN A S . The performance of LSTM and BiLSTM in forecasting time series [C ] // Proceedings of the 2019 IEEE International Conference on Big Data (Big Data) . Piscataway : IEEE Press , 2019 : 3285 - 3292 .

ILIADIS L A , KAIFAS T . Darknet traffic classification using machine learning techniques [C ] // Proceedings of the 2021 10th International Conference on Modern Circuits and Systems Technologies (MOCAST) . Piscataway : IEEE Press , 2021 : 1 - 4 .

LIU Z , MAO H Z , WU C Y , et al . A ConvNet for the 2020s [C ] // Proceedings of the 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) . Piscataway : IEEE Press , 2022 : 11966 - 11976 .

SIRINAM P , IMANI M , JUAREZ M , et al . Deep fingerprinting: undermining website fingerprinting defenses with deep learning [C ] // Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2018 : 1928 - 1943 .

HE H Y , YANG Z G , CHEN X N . PERT: payload encoding representation from Transformer for encrypted traffic classification [C ] // Proceedings of the 2020 ITU Kaleidoscope: Industry-Driven Digital Transformation (ITU K) . Piscataway : IEEE Press , 2020 : 1 - 8 .

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

APEA:a novel method for identifying malicious URL

Research on credit card transaction security supervision based on PU learning

Human action recognition method based on multi-view semi-supervised ensemble learning

Related Author

ZHANG Huifei

YANG Xiuzhang

PENG Guojun

Renfeng CHEN

Hongbin ZHU

Shengnan CHEN

Xinmin FAN

Related Institution

School of Cyber Science and Engineering, Wuhan University

Guizhou Big Data Academy, Guizhou University

Fujian Normal University

Fujian Engineering Research Center, Network Security and Educational Informatization

⁰