Research on Tor Over Socks5 Proxy Anonymous Communication Behavior Reconition

Network traffic, as structured data encapsulating communication behaviors, provides key evidence for analyzing communication relationships. In cyber confrontation, attackers increasingly combine encrypted proxies and anonymous communication systems to bypass threat detection and source tracing mechanisms. The multi-layer protocol encapsulation and multi-hop node relay characteristics of these hybrid anonymous communications pose significant analytical challenges. To tackle these limitations, we propose a novel method for identifying Tor-over-Socks5 proxy anonymous communication behaviors. Our approach constructs two spatiotemporal representations: packetlevel spatiotemporal representation based on graph structures and flow-level spatiotemporal representation based on paragraph semantics. A dual-channel graph and paragraph semantics multihead attention network is developed to mine intrinsic correlations between these multi-scale representations, enabling precise identification of service types within proxy anonymous traffic. Experimental evaluation on Tor over Socks5 traffic datasets demonstrates a superior accuracy in distinguishing typical service types, significantly advancing anonymous communication detection capabilities.