ANFW Detection of the Tor Network Based on ResNet

Tor network is a widely used anonymous communication network that employs techniques such as packet encryption, multi-hop proxying, and traffic obfuscation to ensure the confidentiality and integrity of data transmission while concealing the communication relationship between the sender and receiver. As one of the most technologically advanced and widely used anonymous communication systems, Tor effectively resists traditional attacks such as those based on protocol analysis and traffic analysis. However, Active Network Flow Watermarking (ANFW) attacks pose a significant threat to Tor's anonymity by embedding unique watermark signals into Tor traffic, enabling the tracking of communication targets and substantially degrading Tor's effectiveness in maintaining anonymity. This paper addresses the challenge of detecting ANFW attacks within the Tor network by introducing a residual neural network (ResNet)-based detection method.  Instead of classifying specific watermark types, our approach detects the presence of watermarks in Tor traffic by analyzing behavioral changes induced by ANFW attacks. By considering both statistical and non-statistical features, we transform the detection problem into a classification task that distinguishes between normal and abnormal Tor traffic. Experimental results from real-world Tor network data confirm the effectiveness of our approach in enhancing the detection of ANFW attacks, thereby improving the anonymity provided by Tor.