Benchmarking two techniques for Tor classification: Flow level and circuit level classification

Recently, many Internet users, who seek anonymity, use Tor, which is one of the most popular anonymity software solutions. Tor provides this anonymity by hiding the identity of the user from the destination that the user aims to reach. It also hides the user activities into encrypted cells. In this work, we investigate up to what level we can define what the user in Tor is doing. To this end, we extended on the previous work to classify the user activities using information extracted from Tor circuits and cells. Moreover, we developed a classification system to identify user activities based on traffic flow features. Our results show that flow based classification can reach up to the accuracy of the cell level classification as well as being more flexible.