[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-119899-en":3,"doc-seo-119899-105":30,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":4,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":27,"seo_description":14,"update_tm":28,"read_time":29},119899,3848291630094,"Emma Wilson","https://eur-avatar.wpscdn.com/davatar_085a072bc5b1113ac321206ff7593b45",8,"Research & Report","Classifying Tor Traffic Encrypted Payload Using Machine Learning - Research paper","Tor enables Internet anonymity but also draws malicious use, making efficient Tor traffic monitoring essential. Existing flow-based classification can be unreliable due to asymmetric routing and added delays when computing features from multiple packets. Leveraging Tor’s multi-layer encryption characteristics, the study differentiates Tor and nonTor traffic using deep packet inspection and machine learning based solely on encrypted payloads. Statistical tests and feature-based learning across 8 application groups achieve 94.53% differentiation and 95.65% average accuracy, independent of payload position in the traffic flow.","Received 28 December 2023, accepted 9 January 2024, date of publication 19 January 2024, date of current version 8 February 2024. Digital Object Identifier 10.1109/ACCESS.2024.3356073  \nClassifying Tor Traffic Encrypted Payload Using Machine Learning  \nPITPIMON CHOOROD1,(Member, IEEE), GEORGE WEIR1,(Senior Member, IEEE), AND ANIL FERNANDO 1,2  \n1Department of Computer and Information Sciences, University of Strathclyde, G1 1XH Glasgow, U.K.  \n2Centre for Vision, Speech and Signal Processing, Department of Electrical and Electronic Engineering, University of Surrey, GU2 7XH Guildford, U.K. Corresponding author: Anil Fernando ([anil.fernando@surrey.ac.uk](anil.fernando@surrey.ac.uk))  \nABSTRACT Tor, a network offering Internet anonymity, presented both positive and potentially malicious applications, leading to the need for efficient Tor traffic monitoring. While most current traffic classification methods rely on flow-based features, these can be unreliable due to factors like asymmetric routing, and the use of multiple packets for feature computation can lead to processing delays. Recognising the multi-layered encryption of Tor compared to nonTor encrypted payloads, our study explored distinct patterns in their encrypted data. We introduced a novel method using Deep Packet Inspection and machine learning to differentiate between Tor and nonTor traffic based solely on encrypted payload. In the first strand of our research, we investigated hex character analysis of the Tor and nonTor encrypted payloads through statistical testing across 8 groups of application types. Remarkably, our investigation revealed a significant differentiation rate of 94 .53% between Tor and nonTor traffic. In the second strand of our research, we aimed to distinguish Tor and nonTor traffic using machine learning, based on encrypted payload features. This proposed feature-based approach proved effective, as evidenced by our classification performance, which attained an average accuracy rate of 95.65% across these 8 groups of applications. Thereby, this study contributes to the efficient classification of Tor and nonTor traffic through features derived solely from a single encrypted payload packet, independent of its position in the traffic flow.  \nINDEX TERMS Network traffic classification, Tor network, machine learning, encrypted payload features, character analysis.  \nI. INTRODUCTION  \nTor [1] is an anonymous network that offers a significant advantage in providing privacy to Tor users by concealing their identities. Tor achieves anonymity by routing its traffic through a series of relays within the Tor network, which is maintained and operated by volunteers worldwide. This complicated process makes it difficult to trace the origin of Tor traffic because the multi-layered process of relaying traffic conceals users’ actual IP addresses before reaching their destination. This anonymity protects a wide range of individuals, from regular internet users who wish to evade ISP tracking to journalists and activists who seek a secure connection without revealing their identities. However, Tor’s benefits also attract criminals for illicit  \nThe associate editor coordinating the review of this manuscript and  \napproving it for publication was Jose Saldana  .  \nactivities such as accessing child pornography or conducting cyberattacks, without fear of detection. While Tor effectively shields users’ identities, locations, and activities, it cannot entirely hide the network traffic generated during its usage.  \nTo date, several methods have been proposed for Tor traffic classification. Many studies have emphasised flow-based features since Tor traffic has distinctive latency patterns [1],[2] . However, asymmetric routing could make such a method less reliable [3], and computing multiple packets for feature extraction can introduce processing delays. An alternative approach focuses on the dominant packet properties of Tor fixed-cell size to detect Tor traffic [4], but","cbCaivKPVDK6cxrv","https://ap.wps.com/l/cbCaivKPVDK6cxrv","pdf",1321128,1,14,"English","en",105,"# Introduction\n## Motivation and problem with flow-based methods\n## Tor encryption characteristics and research question\n## DPI-based character analysis approach\n## Encrypted payload feature-based machine learning","[{\"question\":\"Why are flow-based Tor traffic classification methods unreliable?\",\"answer\":\"They can be undermined by asymmetric routing and by processing delays caused by extracting features from multiple packets.\"},{\"question\":\"What is the core idea of the proposed method?\",\"answer\":\"It uses deep packet inspection and machine learning to distinguish Tor from nonTor traffic using features derived solely from encrypted payloads, without needing decryption.\"},{\"question\":\"How effective is the approach across application types?\",\"answer\":\"Hex-character statistical testing across 8 application groups shows a 94.53% differentiation rate, while machine-learning classification reaches an average accuracy of 95.65% across the same groups.\"}]","Classifying Tor Traffic Encrypted Payload Using Machine Learning - Research paper | PDF",1785726899,35,{"code":4,"msg":31,"data":32},"ok",{"site_id":24,"language":23,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":28},"classifying-tor-traffic-encrypted-payload-using-machine-learning-research-paper","",{"@graph":36,"@context":85},[37,54,68],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,48,51],{"item":41,"name":42,"@type":43,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":47},"https://docshare.wps.com/document/","Document",2,{"item":49,"name":12,"@type":43,"position":50},"https://docshare.wps.com/document/research-report/",3,{"item":52,"name":13,"@type":43,"position":53},"https://docshare.wps.com/document/classifying-tor-traffic-encrypted-payload-using-machine-learning-research-paper/119899/",4,{"url":52,"name":13,"@type":55,"author":56,"headline":13,"publisher":58,"fileFormat":61,"inLanguage":23,"description":14,"dateModified":62,"datePublished":62,"encodingFormat":61,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":57},"Person",{"url":41,"name":59,"@type":60},"DocShare","Organization","application/pdf","2026-08-03",true,{"@type":65,"interactionType":66,"userInteractionCount":4},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"Why are flow-based Tor traffic classification methods unreliable?","Question",{"text":75,"@type":76},"They can be undermined by asymmetric routing and by processing delays caused by extracting features from multiple packets.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"What is the core idea of the proposed method?",{"text":80,"@type":76},"It uses deep packet inspection and machine learning to distinguish Tor from nonTor traffic using features derived solely from encrypted payloads, without needing decryption.",{"name":82,"@type":73,"acceptedAnswer":83},"How effective is the approach across application types?",{"text":84,"@type":76},"Hex-character statistical testing across 8 application groups shows a 94.53% differentiation rate, while machine-learning classification reaches an average accuracy of 95.65% across the same groups.","https://schema.org",{"og:url":52,"og:type":87,"og:title":13,"og:site_name":59,"og:description":14},"article",{"robots":89,"canonical":52},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,120,123,128,131,135],{"id":20,"doc_module":4,"doc_module_name":46,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":47,"doc_module":4,"doc_module_name":46,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":53,"doc_module":4,"doc_module_name":46,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":46,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":46,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":46,"category_name":117,"show_sort_weight":118,"slug":119},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":121,"slug":122},30,"research-report",{"id":124,"doc_module":4,"doc_module_name":46,"category_name":125,"show_sort_weight":126,"slug":127},9,"Religion & Spirituality",20,"religion-spirituality",{"id":126,"doc_module":4,"doc_module_name":46,"category_name":129,"show_sort_weight":126,"slug":130},"World Cup","world-cup",{"id":132,"doc_module":4,"doc_module_name":46,"category_name":133,"show_sort_weight":132,"slug":134},10,"Lifestyle","lifestyle",{"id":136,"doc_module":4,"doc_module_name":46,"category_name":137,"show_sort_weight":106,"slug":138},19,"General","general"]