Snowflake Anonymous Network Traffic Identification

Abstract

Tor, as a widely used anonymous communication system, is frequently employed by some users for illegal activities. Snowflake server as a plugin that enables users to connecting to the Tor network, allowing users to evade surveillance by connecting to the Tor network through it. Since Snowflake hides user traffic within regular WebRTC, it becomes challenging for authorities to differentiate and regulate, posing significant difficulties in monitoring efforts. To address these issues, this paper proposes a feature extraction method based on traffic statistical characteristics and a Snowflake traffic identification model based on MLP. We collected traffic datasets in Docker environment, extracted variable-length DTLS handshake sequences, and employed the feature extraction method to extract their statistical characteristics, including packet length, session duration, and average time between sending two packets, among other features. The MLP-based Snowflake traffic identification model can determine whether the traffic belongs to the target traffic based on these features. Moreover, this method can accurately identify traffic even when the traffic fields change. Experimental results demonstrate that this method achieves a 99.83% accuracy rate in identifying Snowflake traffic. Additionally, even when the data distribution in the dataset is altered, although the method requires more training iterations, it still achieves a 99.67% accuracy rate.