TOScorr: Transformer-based Flow Correlation Attack on Tor Onion Service

The proliferation of illegal information and criminal activities on anonymous networks has driven the demand for effective deanonymization attacks against Tor, which emerging learning algorithms have successfully achieved through flow correlation techniques. However, the feasibility of developing flow correlation methods specifically for Tor onion services remains an open challenge. In this paper, we propose TOScorr, an effective deep learning-based flow correlation attack that enables high-precision deanonymization of onion service sessions. To accommodate the high variability of onion service traffic, TOScorr uses aggregated features of flow pairs as robust inputs and employs a novel encoding module with Transformer self-attention mechanisms added to capture information embedded in both local and global contexts. Experimental results show that TOScorr is more scalable and practically effective in correlating onion services compared to previous methods.