Arash Habibi Lashkari
Gerard Draper Gil
Mohammad Saiful Islam Mamun
Ali A. Ghorbani
University of New Brunswick (UNB), Canada
Tor, Network Traffic Characterization, Network Traffic Analysis, Time-based Features, Machine Learning.
Information and Systems Security
Traffic classification has been the topic of many research efforts, but the quick evolution of Internet services
and the pervasive use of encryption makes it an open challenge. Encryption is essential in protecting the
privacy of Internet users, a key technology used in the different privacy enhancing tools that have appeared in
the recent years. Tor is one of the most popular of them, it decouples the sender from the receiver by encrypting
the traffic between them, and routing it through a distributed network of servers. In this paper, we present a
time analysis on Tor traffic flows, captured between the client and the entry node. We define two scenarios,
one to detect Tor traffic flows and the other to detect the application type: Browsing, Chat, Streaming, Mail,
Voip, P2P or File Transfer. In addition, with this paper we publish the Tor labelled dataset we generated and
used to test our classifiers.