TriViewNet: Achieve Accurate Tor Hidden Service Classification by Multi-View Feature Extraction and Fusion

Tor has provided hidden services (HS) and protected the anonymity of the Web server with hidden service directory servers. Some criminals use hidden services to engage in illegal activities, such as anonymous transactions, pirated distribution, hacking, etc. In order to protect the security of cyberspace, hidden service traffic needs to be deanonymized. Artificial intelligence-based methods have become the most promising, but there are still two shortcomings in current research work. First, some of them mainly uses the size and direction sequence of the data packet as the input to complete the recognition, without mining the features of network traffic from many views. Second, they extract information from different view, but just concatenate them together instead of fuse them densely. Therefore, in this paper we propose a Tor hidden service traffic identification method with multi views named TriViewNet. TriViewNet extracts information from three different views, local flow, TLS layer, and TCP layer for identification ad fuses them with Tri-attention module. By comparing with state-of-the-art models, the results show that our TriViewNet outperforms in the recognition of Tor HS traffic.