RECTor: Robust and Efficient Correlation Attack on Tor
Binghui Wu, Dinil Mon Divakaran, Levente Csikor, Mohan Gurusamy

TL;DR
RECTor introduces a machine learning framework that significantly improves traffic correlation accuracy and efficiency in Tor, exposing vulnerabilities and emphasizing the need for stronger defenses.
Contribution
It presents a novel attention-based MIL and GRU approach for robust, scalable traffic correlation under realistic, noisy conditions.
Findings
Outperforms state-of-the-art methods by up to 60% in true positive rate.
Reduces training and inference time by over 50%.
Demonstrates near-linear scalability with increasing flow data.
Abstract
Tor is a widely used anonymity network that conceals user identities by routing traffic through encrypted relays, yet it remains vulnerable to traffic correlation attacks that deanonymize users by matching patterns in ingress and egress traffic. However, existing correlation methods suffer from two major limitations: limited robustness to noise and partial observations, and poor scalability due to computationally expensive pairwise matching. To address these challenges, we propose RECTor, a machine learning-based framework for traffic correlation under realistic conditions. RECTor employs attention-based Multiple Instance Learning (MIL) and GRU-based temporal encoding to extract robust flow representations, even when traffic data is incomplete or obfuscated. These embeddings are mapped into a shared space via a Siamese network and efficiently matched using approximate nearest neighbor…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsInternet Traffic Analysis and Secure E-voting · Wireless Signal Modulation Classification · Network Security and Intrusion Detection
