Tor miner and pool communication flow detection method based on cell anonymous interaction periodicity

Abstract

The application provides a Tor miner and pool communication flow detection method based on the periodic characteristics of anonymous interaction of cells, which is divided into five parts. The first part is to construct a Tor data set, including capturing encrypted Tor miner and pool communication flow and collecting public Tor application flow as background flow. The second part is data preprocessing, including group flow, removing failed cases and cutting Tor cell operation. The third part is to divide the time window based on time sequence aggregation, and to determine the periodic window size according to the aggregation point time interval and the density. The fourth part is to extract the flow interaction features in the time window based on the communication interaction mechanism of the miner and the pool in the Tor network. The fifth part is to use a machine learning classification model to identify Tor miner and pool communication flow, and to determine the appropriate classification model based on various evaluation indexes. The application can effectively identify the miner and pool communication behavior flow existing in the current Tor network, and the detection effect accuracy reaches 99%.

Images