FlowCoPCL: Enhanced Flow Correlation Attacks on Tor Using Patching and Contrastive Learning

Abstract Flow correlation is a key technique for deanonymization attacks on Tor, while Tor can be used to achieve anonymous communication between Internet of Things (IoT) nodes in edge intelligence. Recent works treat flows as time series and use Convolutional Neural Network (CNN) to extract flow embeddings to improve the effectiveness of flow correlation attacks. However, unlike the consistent time intervals of data points in general time series, the arrival time intervals between flow packets are unequal, so the flow embeddings extracted are temporal inconsistent, which affects the effectiveness of flow correlation attacks. To address this challenge, we propose enhanced Flow Correlation attacks on Tor using Patching and Contrastive Learning (FlowCoPCL). First, FlowCoPCL uses a time-based patching mechanism to split the flow into patches of the same duration. The patch embeddings are extracted as the input of the CNN model to ensure the temporal consistency of the flow embeddings. Second, FlowCoPCL adapts the contrastive learning framework SimCLR to train the feature embedding networks, which enables the model to learn flow embeddings efficiently. The experimental results demonstrate that FlowCoPCL significantly outperforms existing flow correlation attacks on Tor, achieving over 99% True Positive Rate (TPR) at 10−5 False Positive Rate (FPR). Additionally, FlowCoPCL shows the robustness against website fingerprinting defenses.