Adversaries monitoring Tor traffic crossing their jurisdictional border and reconstructing Tor circuits

2018/08/28 by Herman Galteland, Galteland, Herman, Kristian Gjøsteen +1
Computer Science · #Adversarial Robustness in Machine Learning #Cryptography and Security (cs.CR) #Digital Media Forensic Detection #FOS: Computer and information sciences #Internet Traffic Analysis and Secure E-voting #Network Security and Intrusion Detection #cs.CR

paper · pdf · doi:10.48550/arxiv.1808.09237

openalex publication_date 2018/08/28 · arxiv created 2020/01/21 · arxiv updated 2020/01/22 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

We model and analyze passive adversaries that monitors Tor traffic crossing the border of a jurisdiction an adversary is controlling. We show that a single adversary is able to connect incoming and outgoing traffic of their border, tracking the traffic, and cooperating adversaries are able to reconstruct parts of the Tor network, revealing user-server relationships. In our analysis we created two algorithms to estimate the capabilities of the adversaries. The first generates Tor-like traffic and the second analyzes and reconstructs the simulated data.

Related

• A traffic analysis attack against Introduction Protocol and Onion Services
• Measuring and mitigating AS-level adversaries against Tor
• Defending Tor from Network Adversaries: A Case Study of Network Path Prediction
• Holding all the ASes: Identifying and Circumventing the Pitfalls of AS-aware Tor Client Design
• Onions in the Crosshairs: When The Man really is out to get you