Matrix of Fused Features-based Approach for Tor Application Classification

Encrypted traffic identification is critical for detecting network attacks and improving the quality of service, making it an essential aspect of cyberspace security. However, existing methods for classifying Tor applications are limited by their reliance on single packet size or time-related features of traffic flows, which limits the potential for improving classification accuracy. To address this challenge, we propose an end-to-end classification framework called the Matrix of Fused Features Network (MFFN). This framework fuses direction, packet size, and time-related features of the raw flows to generate matrices that represent Tor applications. We then use the residual net-work, a popular deep learning model, to automatically extract potential features from these matrices and classify them into Tor applications. We evaluate our approach on the public dataset ISCXTor2016, and experimental results demonstrate that MFFN achieves 97% accuracy for Tor application classification, outperforming existing methods.