Inproceedings,
Anonymity Services Tor, I2P, JonDonym: Classifying in the Dark
29th International Teletraffic Congress (ITC 29), Genoa, Italy, (2017)
Abstract
Traffic classification, i.e. associating network traffic to the application that generated it, is an important tool for several tasks, spanning on different fields (security, management, traffic engineering, R&D). This process is challenged by applications that preserve Internet users' privacy by encrypting the communication content, and even more by anonymity tools, additionally hiding the source, the destination, and the nature of the communication. In this paper, leveraging a public data set released in 2017, we provide classification results with the aim of investigating to what degree the specific anonymity tool (and the traffic it hides) can be identified, when compared to the traffic of the other considered anonymity tools, using machine learning approaches based on the sole statistical features. To this end, four classifiers are trained and tested on the dataset: (i) Naive Bayes, (ii) Bayesian Network, (iii) C4.5, and (iv) Random Forests. Results show that the three anonymity tools (Tor, I2P, JonDonym) can be easily distinguished (accuracy 99.99%), and even the specific kind of traffic they carry (e.g., web browsing, chat, video, etc.) can be inferred (accuracy 98.25%). By providing an in-depth analysis of the aforementioned dataset and a detailed description of the present study, we foster repeatability and further research on anonymity tools traffic classification.
