Detecting and Attributing Tor-Obfuscated Malware Communications Through Traffic Fingerprinting

As malware authors increasingly adopt anonymity networks like Tor to obfuscate Command & Control communications and evade detection, defenders face the challenge of distinguishing malicious from benign traffic in an environment designed for privacy.This study investigates whether malware traffic routed through Tor can still be identified despite the network's encryption, packet normalization, and routing obfuscation mechanisms.Using a controlled empirical setup, we executed 13 diverse malware samples spanning 10 families, generating 693 Tor-obfuscated traffic traces.Through feature engineering focusing on statistical, temporal, and burst characteristics, and leveraging machine learning classifiers, we demonstrate that malware retains distinct traffic patterns even within anonymized environments.Our classifiers achieved up to 89.9 % accuracy in identifying malware families, highlighting the persistence of identifiable temporal and statistical characteristics.These findings demonstrate that malware fingerprinting remains feasible even in anonymized environments, providing actionable insights for defenders and privacy-preserving approaches for detecting malicious activity.However, our results also underscore potential fingerprinting risks for anonymity systems like Tor, prompting a need for stronger traffic normalization techniques.This study bridges the gap between malware analysis and anonymity research, offering a foundation to balance user privacy with effective threat detection.