{"id":"https://openalex.org/W4391019849","doi":"https://doi.org/10.1109/access.2024.3356073","title":"Classifying Tor Traffic Encrypted Payload Using Machine Learning","display_name":"Classifying Tor Traffic Encrypted Payload Using Machine Learning","publication_year":2024,"publication_date":"2024-01-01","ids":{"openalex":"https://openalex.org/W4391019849","doi":"https://doi.org/10.1109/access.2024.3356073"},"language":"en","primary_location":{"id":"doi:10.1109/access.2024.3356073","doi":"https://doi.org/10.1109/access.2024.3356073","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2024.3356073","pdf_url":"https://ieeexplore.ieee.org/ielx7/6287639/6514899/10409147.pdf","source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["anvur-scientific","cwts-core","doaj","jufo-1","ki-jl-1","norway-1","oarl","poland-100","russia-white-list-1","vabb-shw"],"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"volume":null,"type":"article","is_traditional":true,"indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://ieeexplore.ieee.org/ielx7/6287639/6514899/10409147.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5009909491","display_name":"Pitpimon Choorod","orcid":"https://orcid.org/0000-0002-9279-0710","observed_orcids":["https://orcid.org/0000-0002-9279-0710"]},"institutions":[{"id":"https://openalex.org/I181647926","display_name":"University of Strathclyde","ror":"https://ror.org/00n3w3b69","country_code":"GB","type":"education","lineage":["https://openalex.org/I181647926"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Pitpimon Choorod","raw_affiliation_strings":["Department of Computer and Information Sciences, University of Strathclyde, Glasgow, U.K"],"raw_orcid":"https://orcid.org/0000-0002-9279-0710","affiliations":[{"raw_affiliation_string":"Department of Computer and Information Sciences, University of Strathclyde, Glasgow, U.K","institution_ids":["https://openalex.org/I181647926"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5005334221","display_name":"George R. S. Weir","orcid":"https://orcid.org/0000-0002-6264-4480","observed_orcids":["https://orcid.org/0000-0002-6264-4480"]},"institutions":[{"id":"https://openalex.org/I181647926","display_name":"University of Strathclyde","ror":"https://ror.org/00n3w3b69","country_code":"GB","type":"education","lineage":["https://openalex.org/I181647926"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"George Weir","raw_affiliation_strings":["Department of Computer and Information Sciences, University of Strathclyde, Glasgow, U.K"],"raw_orcid":"https://orcid.org/0000-0002-6264-4480","affiliations":[{"raw_affiliation_string":"Department of Computer and Information Sciences, University of Strathclyde, Glasgow, U.K","institution_ids":["https://openalex.org/I181647926"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5111819494","display_name":"Anil Fernando","orcid":"https://orcid.org/0000-0002-2158-2367","observed_orcids":["https://orcid.org/0000-0002-2158-2367"]},"institutions":[{"id":"https://openalex.org/I181647926","display_name":"University of Strathclyde","ror":"https://ror.org/00n3w3b69","country_code":"GB","type":"education","lineage":["https://openalex.org/I181647926"]},{"id":"https://openalex.org/I28290843","display_name":"University of Surrey","ror":"https://ror.org/00ks66431","country_code":"GB","type":"education","lineage":["https://openalex.org/I28290843"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Anil Fernando","raw_affiliation_strings":["Department of Computer and Information Sciences, University of Strathclyde, Glasgow, U.K","Department of Electrical and Electronic Engineering, Centre for Vision, Speech and Signal Processing, University of Surrey, Guildford, UK"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer and Information Sciences, University of Strathclyde, Glasgow, U.K","institution_ids":["https://openalex.org/I181647926"]},{"raw_affiliation_string":"Department of Electrical and Electronic Engineering, Centre for Vision, Speech and Signal Processing, University of Surrey, Guildford, UK","institution_ids":["https://openalex.org/I28290843"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":{"value":1995,"currency":"USD","value_usd":1995},"apc_paid":{"value":1995,"currency":"USD","value_usd":1995},"fwci":2.532,"has_fulltext":true,"cited_by_count":24,"citation_normalized_percentile":{"value":0.91021973,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":98,"max":99},"biblio":{"volume":"12","issue":null,"first_page":"19418","last_page":"19431"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/deep-packet-inspection","display_name":"deep packet inspection","score":0.8519999980926514},{"id":"https://openalex.org/keywords/network-traffic-monitoring","display_name":"network traffic monitoring","score":0.593999981880188},{"id":"https://openalex.org/keywords/anonymity-networks","display_name":"anonymity networks","score":0.5109999775886536}],"concepts":[{"id":"https://openalex.org/C134066672","wikidata":"https://www.wikidata.org/wiki/Q1424639","display_name":"Payload (computing)","level":3,"score":0.921668529510498},{"id":"https://openalex.org/C148730421","wikidata":"https://www.wikidata.org/wiki/Q141090","display_name":"Encryption","level":2,"score":0.8538610935211182},{"id":"https://openalex.org/C169988225","wikidata":"https://www.wikidata.org/wiki/Q7832484","display_name":"Traffic classification","level":3,"score":0.7758868336677551},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7691307067871094},{"id":"https://openalex.org/C204679922","wikidata":"https://www.wikidata.org/wiki/Q734252","display_name":"Deep packet inspection","level":3,"score":0.6967868804931641},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.6492499113082886},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.5143407583236694},{"id":"https://openalex.org/C178005623","wikidata":"https://www.wikidata.org/wiki/Q308859","display_name":"Anonymity","level":2,"score":0.4881232678890228},{"id":"https://openalex.org/C63969886","wikidata":"https://www.wikidata.org/wiki/Q3536440","display_name":"Internet traffic","level":3,"score":0.46805256605148315},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.447584331035614},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.39925751090049744},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.3719463348388672},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.34984785318374634},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.32484835386276245},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.1372404396533966},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.08769640326499939},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.0},{"id":"https://openalex.org/C41895202","wikidata":"https://www.wikidata.org/wiki/Q8162","display_name":"Linguistics","level":1,"score":0.0}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1109/access.2024.3356073","doi":"https://doi.org/10.1109/access.2024.3356073","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2024.3356073","pdf_url":"https://ieeexplore.ieee.org/ielx7/6287639/6514899/10409147.pdf","source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["anvur-scientific","cwts-core","doaj","jufo-1","ki-jl-1","norway-1","oarl","poland-100","russia-white-list-1","vabb-shw"],"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},{"id":"pmh:oai:strathprints.strath.ac.uk:88853","doi":null,"is_oa":true,"landing_page_url":"https://strathprints.strath.ac.uk/view/author/1093003.html>","pdf_url":"https://strathprints.strath.ac.uk/88853/7/Choorod-etal-IEEE-Access-2024-Classifying-Tor-traffic-encrypted-payload-using-machine-learning.pdf","source":{"id":"https://openalex.org/S4306402226","display_name":"Strathprints: The University of Strathclyde institutional repository (University of Strathclyde)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I181647926","host_organization_name":"University of Strathclyde","host_organization_lineage":["https://openalex.org/I181647926"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"acceptedVersion","is_accepted":true,"is_published":false,"raw_source_name":null,"raw_type":"Article"},{"id":"pmh:oai:doaj.org/article:60dbc33316f24c3ea83cfa4e25e10838","doi":null,"is_oa":true,"landing_page_url":"https://doaj.org/article/60dbc33316f24c3ea83cfa4e25e10838","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"IEEE Access, Vol 12, Pp 19418-19431 (2024)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1109/access.2024.3356073","doi":"https://doi.org/10.1109/access.2024.3356073","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2024.3356073","pdf_url":"https://ieeexplore.ieee.org/ielx7/6287639/6514899/10409147.pdf","source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["anvur-scientific","cwts-core","doaj","jufo-1","ki-jl-1","norway-1","oarl","poland-100","russia-white-list-1","vabb-shw"],"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4391019849.pdf","grobid_xml":"https://content.openalex.org/works/W4391019849.grobid-xml"},"referenced_works_count":29,"referenced_works":["https://openalex.org/W586844895","https://openalex.org/W1510688672","https://openalex.org/W1577581905","https://openalex.org/W1655958391","https://openalex.org/W1996360405","https://openalex.org/W2001984188","https://openalex.org/W2133990480","https://openalex.org/W2142827986","https://openalex.org/W2230451675","https://openalex.org/W2409437973","https://openalex.org/W2591712613","https://openalex.org/W2742891804","https://openalex.org/W2782597251","https://openalex.org/W2897202622","https://openalex.org/W2904326537","https://openalex.org/W2979950223","https://openalex.org/W2989571961","https://openalex.org/W3036573907","https://openalex.org/W3114031232","https://openalex.org/W3132467470","https://openalex.org/W3139172628","https://openalex.org/W3159644993","https://openalex.org/W3160314615","https://openalex.org/W4235200155","https://openalex.org/W4256060553","https://openalex.org/W4293168393","https://openalex.org/W4315928996","https://openalex.org/W6714243528","https://openalex.org/W6795104974"],"related_works":["https://openalex.org/W3160314615","https://openalex.org/W4414993127","https://openalex.org/W4391953287","https://openalex.org/W7162456152","https://openalex.org/W2889726874","https://openalex.org/W4410321189","https://openalex.org/W2904326537","https://openalex.org/W4381744221","https://openalex.org/W4367017364","https://openalex.org/W7123239665"],"abstract_inverted_index":{"Tor,":[0],"a":[1,78,131,209],"network":[2],"offering":[3],"Internet":[4],"anonymity,":[5],"presented":[6],"both":[7],"positive":[8],"and":[9,42,85,92,114,139,154,201],"potentially":[10],"malicious":[11],"applications,":[12],"leading":[13],"to":[14,37,53,63,88,151,195],"the":[15,43,57,112,143,196,219],"need":[16],"for":[17,48],"efficient":[18,197],"Tor":[19,61,91,113,138,153,200],"traffic":[20,25,94,156,203,220],"monitoring.":[21],"While":[22],"most":[23],"current":[24],"classification":[26,175,198],"methods":[27],"rely":[28],"on":[29,97,161],"flow-based":[30],"features,":[31],"these":[32,186],"can":[33,51],"be":[34],"unreliable":[35],"due":[36],"factors":[38],"like":[39],"asymmetric":[40],"routing,":[41],"use":[44],"of":[45,60,104,111,124,135,146,183,189,199,215],"multiple":[46],"packets":[47],"feature":[49],"computation":[50],"lead":[52],"processing":[54],"delays.":[55],"Recognising":[56],"multi-layered":[58],"encryption":[59],"compared":[62],"nonTor":[64,93,115,140,155,202],"encrypted":[65,74,98,116,162,211],"payloads,":[66],"our":[67,101,128,147,174],"study":[68,193],"explored":[69],"distinct":[70],"patterns":[71],"in":[72,218],"their":[73],"data.":[75],"We":[76],"introduced":[77],"novel":[79],"method":[80],"using":[81,157],"Deep":[82],"Packet":[83],"Inspection":[84],"machine":[86,158],"learning":[87],"differentiate":[89],"between":[90,137],"based":[95,160],"solely":[96,207],"payload.":[99],"In":[100,142],"first":[102],"strand":[103,145],"research,":[105,148],"we":[106,149],"investigated":[107],"hex":[108],"character":[109],"analysis":[110],"payloads":[117],"through":[118,204],"statistical":[119],"testing":[120],"across":[121,185],"8":[122,187],"groups":[123,188],"application":[125],"types.":[126],"Remarkably,":[127],"investigation":[129],"revealed":[130],"significant":[132],"differentiation":[133],"rate":[134,182],"94.53%":[136],"traffic.":[141],"second":[144],"aimed":[150],"distinguish":[152],"learning,":[159],"payload":[163,212],"features.":[164],"This":[165],"proposed":[166],"feature-based":[167],"approach":[168],"proved":[169],"effective,":[170],"as":[171],"evidenced":[172],"by":[173],"performance,":[176],"which":[177],"attained":[178],"an":[179],"average":[180],"accuracy":[181],"95.65%":[184],"applications.":[190],"Thereby,":[191],"this":[192],"contributes":[194],"features":[205],"derived":[206],"from":[208],"single":[210],"packet,":[213],"independent":[214],"its":[216],"position":[217],"flow.":[221]},"counts_by_year":[{"year":2026,"cited_by_count":9},{"year":2025,"cited_by_count":9},{"year":2024,"cited_by_count":6}],"updated_date":"2026-11-10T11:39:43.021295","created_date":"2024-01-20T00:00:00"}