Analysis of TOR Artifacts and Traffic in Windows 11: A Virtual Lab Approach and Dataset Creation

The rapid spread of TOR (The Onion Router) for anonymized communication and internet browsing raises relevant security concerns due to its frequent use in illicit activities. This research is centered around a comprehensive analysis of TOR artifacts on Windows 11 and the creation of a relevant dataset to aid researchers. The study commences with a thorough review and comparative assessment of the existing literature on TOR artifacts and traffic examination. Windows 11 TOR browser artifacts are identified and placed together with those in Windows 10 and preceding versions. The paper's core methodology involves establishing a virtual lab environment, facilitating integration, simulating TOR network traffic, and gathering network forensics artifacts. A comprehensive dataset, assimilated from traffic logs procured from tools such as Wireshark, snort, Suricata, and pfsense firewall, is designed and used to construct machine learning models for TOR traffic detection. Combining these traffic logs into a particular dataset enhances the accuracy and efficiency of the machine-learning models. The findings of this study provide important insights into the evolving landscape of TOR browser artifacts and traffic patterns on different Windows versions. The proposed models showcase impressive accuracy in identifying TOR traffic. This research is crucial in enhancing our knowledge of TOR traffic analysis. It lays the groundwork for further investigations to enhance the detection and prevention of malicious activities utilizing the TOR network. Moreover, it contributes to developing a valuable dataset that can aid ML researchers in future endeavors.