基于半监督学习的Tor匿名网络加密流量分类方法研究

曹庆伟; 宫良一; 李雨芙; 莫秀良; 杨科; 袁亚丽

doi:10.11959/j.issn.2096-109x.2025070

您当前的位置：

首页 >

文章列表页 >

基于半监督学习的Tor匿名网络加密流量分类方法研究

学术论文 | 更新时间：2026-01-28

- 基于半监督学习的Tor匿名网络加密流量分类方法研究
- Study of semi-supervised learning based encrypted traffic classification method for Tor anonymity network
- 网络与信息安全学报 2025年11卷第6期页码：131-143
- 作者机构：
  
  1.天津理工大学，天津 300384
  2.中国科学院计算机网络信息中心，北京 100083
  3.中国科学院大学，北京 101408
  4.东南大学，江苏南京 211189
- 作者简介：
  
  [ "曹庆伟（2000- ），男，山西临汾人，天津理工大学硕士生，主要研究方向为暗网流量分析、网络空间安全。" ]
  [ "宫良一（1987- ），男，山东烟台人，中国科学院计算机网络信息中心高级工程师，主要研究方向为互联网安全、物联网安全。" ]
  [ "李雨芙（2000- ），女，重庆人，中国科学院大学硕士生，主要研究方向为网络空间安全。" ]
  [ "莫秀良（1969- ），男，天津人，天津理工大学副教授，主要研究方向为网络与信息安全。" ]
  [ "杨科（2002- ），男，河北石家庄人，天津理工大学硕士生，主要研究方向为网络空间安全。" ]
  [ "袁亚丽（1986- ），女，河南周口人，东南大学副研究员，主要研究方向为网络流量安全分析、协议逆向、漏洞挖掘、网络攻防、暗网、人工智能安全。" ]
- 基金信息：
  
  国家重点研发计划(2023YFB3106700)
- DOI：10.11959/j.issn.2096-109x.2025070
  中图分类号： TP393
- 收稿：2025-04-28，
  
  修回：2024-06-17，
  
  纸质出版：2025-12-25
- 稿件说明：
移动端阅览
曹庆伟, 宫良一, 李雨芙, 等. 基于半监督学习的Tor匿名网络加密流量分类方法研究[J]. 网络与信息安全学报, 2025, 11(6): 131-143.

CAO Qingwei, GONG Liangyi, LI Yufu, et al. Study of semi-supervised learning based encrypted traffic classification method for Tor anonymity network[J]. Chinese Journal of Network and Information Security, 2025, 11(6): 131-143.
曹庆伟, 宫良一, 李雨芙, 等. 基于半监督学习的Tor匿名网络加密流量分类方法研究[J]. 网络与信息安全学报, 2025, 11(6): 131-143. DOI： 10.11959/j.issn.2096-109x.2025070.

CAO Qingwei, GONG Liangyi, LI Yufu, et al. Study of semi-supervised learning based encrypted traffic classification method for Tor anonymity network[J]. Chinese Journal of Network and Information Security, 2025, 11(6): 131-143. DOI： 10.11959/j.issn.2096-109x.2025070.

摘要

Tor（the onion routing）匿名网络的多层加密和动态中继机制，给流量分类带来了巨大挑战。传统流量识别技术难以有效检测Tor匿名网络流量中的非法应用或网站流量。针对这一问题提出一种基于半监督学习的Tor匿名网络加密流量分类方法。该方法采用“预训练+微调”的统一框架，通过充分挖掘无标签数据的价值提升分类效能。在预训练阶段，设计了动态掩码机制，通过逐步调整掩蔽比例增强模型的特征学习能力；在微调阶段，引入通道与空间注意力（channel and spatial attention

CSA）模块，提升模型对局部关键区域的感知精度。该方法以Transformer为基础架构，兼具自监督特征提取与判别能力增强能力。实验结果表明，在ISCXTor2016与自采暗网数据集上，所提方法在对8类典型流量进行分类时，各项性能指标均超过98%，展现出优异的泛化能力与应用价值。

Abstract

The onion routing (Tor) anonymous network

due to its multi-layer encryption and dynamic relay mechanisms

posed significant challenges for traffic classification. Illegal applications or websites traffic hidden within Tor anonymous network traffic could not be effectively detected by traditional traffic identification techniques. To address this issue a semi-supervised learning-based method for encrypted traffic classification in Tor networks was proposed. A unified "pretraining + fine-tuning" framework was utilized to fully leverage unlabeled data. In the pretraining phase

a dynamic masking mechanism was introduced to gradually adjust the masking ratio

enhancing the model’s ability to learn latent features. In the fine-tuning phase

a channel and spatial attention (CSA) module was integrated to improve the model’s sensitivity to critical local regions. The overall approach was built on a Transformer-based architecture

combining self-supervised feature extraction with enhanced discriminative capability. Experimental results on the ISCXTor2016 dataset and a self-collected dark web traffic dataset showed that the proposed method achieved over 98% across all performance metrics in classifying eight typical traffic categories

demonstrating excellent generalization ability and practical value.

关键词

Keywords

references

罗军舟 , 杨明 , 凌振 , 等 . 匿名通信与暗网研究综述 [J ] . 计算机研究与发展 , 2019 , 56 ( 1 ): 103 - 130 .

LUO J Z , YANG M , LING Z , et al . Anonymous communication and darknet: a survey [J ] . Journal of Computer Research and Development , 2019 , 56 ( 1 ): 103 - 130 .

翟明芳 , 张兴明 , 赵博 . 基于深度学习的加密恶意流量检测研究 [J ] . 网络与信息安全学报 , 2020 , 6 ( 3 ): 66 - 77 .

ZHAI M F , ZHANG X M , ZHAO B . Survey of encrypted malicious traffic detection based on deep learning [J ] . Chinese Journal of Network and Information Security , 2020 , 6 ( 3 ): 66 - 77 .

CHANG H W , ZHANG H , JIANG L , et al . MaskGIT: masked generative image Transformer [C ] // Proceedings of the 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) . Piscataway : IEEE Press , 2022 : 11305 - 11315 .

HU J , SHEN L , SUN G . Squeeze-and-excitation networks [C ] // Proceedings of the 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition . Piscataway : IEEE Press , 2018 : 7132 - 7141 .

KUHN C , HOFHEINZ D , RUPP A , et al . Onion routing with replies [C ] // Proceedings of the 27th International Conference on the Theory and Application of Cryptology and Information Security . Berlin : Springer , 2021 : 573 - 604 .

DINGLEDINE R , MATHEWSON N , SYVERSON P F . Tor: the second-generation onion router [C ] // Proceedings of the 13th USENIX Security Symposium . Berkeley : USENIX Association , 2004 : 303 - 320 .

ABDULLAH A M . Advanced encryption standard (AES) algorithm to encrypt and decrypt data [J ] . Cryptography and Network Security , 2017 , 16 ( 1 ): 11 .

HABIBI LASHKARI A , DRAPER GIL G , MAMUN M S I , et al . Characterization of tor traffic using time based features [C ] // Proceedings of the 3rd International Conference on Information Systems Security and Privacy . Porto ： SciTePress , 2017 : 253 - 262 .

CHOOROD P , WEIR G . Tor traffic classification based on encrypted payload characteristics [C ] // Proceedings of the 2021 National Computing Colleges Conference (NCCC) . Piscataway : IEEE Press , 2021 : 1 - 6 .

ILIADIS A L , KAIFAS T . Darknet traffic classification using machine learning techniques [C ] // Proceedings of the 10th International Conference on Modern Circuits and Systems Technologies . Piscataway : IEEE Press , 2021 : 1 - 4 .

LASHKARI A H , KAUR G , RAHALI A . DIDarknet: a contemporary approach to detect and characterize the darknet traffic using deep image learning [C ] // Proceedings of the 10th International Conference on Communication and Network Security . New York : ACM , 2020 : 1 - 13 .

KIRUBAVATHI G , AMITHESH Y . Detection and characterization of darknet traffic using attention LSTM with XAI [C ] // Proceedings of the 2024 International Conference on Intelligent Systems for Cybersecurity (ISCS) . Piscataway : IEEE Press , 2024 : 1 - 7 .

ZHU Y H , TAO J , WANG H T , et al . DGNN: accurate darknet application classification adopting attention graph neural network [J ] . IEEE Transactions on Network and Service Management , 2023 , 21 ( 2 ): 1660 - 1671 .

KINGMA D P , BA J , HAMMAD M M . Adam: a method for stochastic optimization [J ] . arXiv Preprint , arXiv: 1412.6980 , 2014 .

LIN X J , XIONG G , GOU G P , et al . ET-BERT: a contextualized datagram representation with pre-training Transformers for encrypted traffic classification [C ] // Proceedings of the ACM Web Conference 2022 . New York : ACM , 2022 : 633 - 642 .

BASSILY R , MORAN S , NANDI A . Learning from mixtures of private and public populations [J ] . Advances in Neural Information Processing Systems , 2020 , 33 : 2947 - 2957 .

ZHAO R J , ZHAN M W , DENG X W , et al . Yet another traffic classifier: a masked autoencoder based traffic Transformer with multi-level flow representation [C ] // Proceedings of the AAAI Conference on Artificial Intelligence WashingtonDC: AAAI Press , 2023 : 5420 - 5427 .

VASWANI A , SHAZEER N , PARMAR N , et al . Attention is all you need [C ] // Proceedings of the Advances in Neural Information Processing Systems . 2017 : 5998 - 6008 .

VAN-EDE T , BORTOLAMEOTTI R , CONTINELLA A , et al . FlowPrint: semi-supervised mobile-app fingerprinting on encrypted network traffic [C ] // Proceedings of the 27th Annual Network and Distributed System Security Symposium . Virginia : the Internet Society , 2020 .

TAYLOR V F , SPOLAOR R , CONTI M , et al . Robust smartphone app identification via encrypted network traffic analysis [J ] . IEEE Transactions on Information Forensics and Security , 2018 , 13 ( 1 ): 63 - 78 .

SIAMI-NAMINI S , TAVAKOLI N , NAMIN A S . The performance of LSTM and BiLSTM in forecasting time series [C ] // Proceedings of the 2019 IEEE International Conference on Big Data (Big Data) . Piscataway : IEEE Press , 2019 : 3285 - 3292 .

ILIADIS L A , KAIFAS T . Darknet traffic classification using machine learning techniques [C ] // Proceedings of the 2021 10th International Conference on Modern Circuits and Systems Technologies (MOCAST) . Piscataway : IEEE Press , 2021 : 1 - 4 .

LIU Z , MAO H Z , WU C Y , et al . A ConvNet for the 2020s [C ] // Proceedings of the 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) . Piscataway : IEEE Press , 2022 : 11966 - 11976 .

SIRINAM P , IMANI M , JUAREZ M , et al . Deep fingerprinting: undermining website fingerprinting defenses with deep learning [C ] // Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2018 : 1928 - 1943 .

HE H Y , YANG Z G , CHEN X N . PERT: payload encoding representation from Transformer for encrypted traffic classification [C ] // Proceedings of the 2020 ITU Kaleidoscope: Industry-Driven Digital Transformation (ITU K) . Piscataway : IEEE Press , 2020 : 1 - 8 .

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

APEA：一种恶意URL新型识别方法

基于PU learning的信用卡交易安全监管研究

基于多视图半监督集成学习的人体动作识别算法