Abstract: The frequent occurrence of network attacks has led to the emergence of anonymous communication systems to protect user privacy. However, these systems have also been exploited by malicious actors to create the dark web for various illegal activities. Monitoring and identifying dark web traffic are crucial for maintaining network security. To address this issue, the MorViT model for Tor dark web traffic fingerprinting is proposed. The model transforms traffic data into images for visualization and model input. It incorporates one-dimensional inverted residual structures, two-dimensional inverted residual structures, and MobileViT modules to extract both local features of traffic and global features with long-range dependencies. To overcome the limitations of Transformers on small datasets, the model introduces learnable temperature coefficients and diagonal masking to enhance local inductive capabilities. Experimental results demonstrate that the MorViT model outperforms existing models in terms of classification accuracy, recall rate, and AUC in closed-world and open-world scenarios, effectively achieving Tor dark web traffic fingerprint recognition tasks.

Key words: the onion router, website fingerprint, darknet, inverted residual structure, ViT model

摘要： 网络攻击日趋频繁，为保护用户隐私，匿名通信系统不断涌现。但这也被不法分子利用，进行各类违法活动而形成暗网。监测和识别暗网流量对维护网络安全具有重要意义。针对上述问题，提出了用于Tor暗网流量的MorViT指纹识别模型。该模型将流量数据转换为图像以便于可视化和模型输入，并融合一维倒残差结构、二维倒残差结构和MobileViT模块，用以同时提取流量局部特征以及整体流量的全局特征和长距离依赖关系。为弥补Transformer在小数据集上的不足，引入可学习的温度系数和对角掩码增强局部归纳能力。实验结果表明，MorViT模型在封闭世界和开放世界场景下的分类准确率、召回率、AUC等指标上均优于既有模型，能够有效完成Tor暗网流量指纹识别任务。

关键词: 洋葱路由, 网站指纹识别, 暗网, 倒残差结构, ViT模型