{"id":"https://openalex.org/W1621730125","doi":"https://doi.org/10.1109/tifs.2015.2465934","title":"TorWard: Discovery, Blocking, and Traceback of Malicious Traffic Over Tor","display_name":"TorWard: Discovery, Blocking, and Traceback of Malicious Traffic Over Tor","publication_year":2015,"publication_date":"2015-08-13","ids":{"openalex":"https://openalex.org/W1621730125","doi":"https://doi.org/10.1109/tifs.2015.2465934","mag":"1621730125"},"language":"en","primary_location":{"id":"doi:10.1109/tifs.2015.2465934","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2015.2465934","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5044255077","display_name":"Zhen Ling","orcid":"https://orcid.org/0000-0001-9691-8702"},"institutions":[{"id":"https://openalex.org/I76569877","display_name":"Southeast University","ror":"https://ror.org/04ct4d772","country_code":"CN","type":"education","lineage":["https://openalex.org/I76569877"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhen Ling","raw_affiliation_strings":["School of Computer Science and Engineering, Southeast University, Nanjing, China","[School of Computer Science & Engineering, Southeast University, Nanjing, China]"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Computer Science and Engineering, Southeast University, Nanjing, China","institution_ids":["https://openalex.org/I76569877"]},{"raw_affiliation_string":"[School of Computer Science & Engineering, Southeast University, Nanjing, China]","institution_ids":["https://openalex.org/I76569877"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5045275291","display_name":"Junzhou Luo","orcid":"https://orcid.org/0000-0001-7518-4367"},"institutions":[{"id":"https://openalex.org/I76569877","display_name":"Southeast University","ror":"https://ror.org/04ct4d772","country_code":"CN","type":"education","lineage":["https://openalex.org/I76569877"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Junzhou Luo","raw_affiliation_strings":["School of Computer Science and Engineering, Southeast University, Nanjing, China","[School of Computer Science & Engineering, Southeast University, Nanjing, China]"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Computer Science and Engineering, Southeast University, Nanjing, China","institution_ids":["https://openalex.org/I76569877"]},{"raw_affiliation_string":"[School of Computer Science & Engineering, Southeast University, Nanjing, China]","institution_ids":["https://openalex.org/I76569877"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100641549","display_name":"Kui Wu","orcid":"https://orcid.org/0000-0002-2069-0032"},"institutions":[{"id":"https://openalex.org/I212119943","display_name":"University of Victoria","ror":"https://ror.org/04s5mat29","country_code":"CA","type":"education","lineage":["https://openalex.org/I212119943"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Kui Wu","raw_affiliation_strings":["Department of Computer Science, University of Victoria, Victoria, BC, Canada","[Department of Computer Science, University of Victoria, Victoria, BC, Canada.]"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science, University of Victoria, Victoria, BC, Canada","institution_ids":["https://openalex.org/I212119943"]},{"raw_affiliation_string":"[Department of Computer Science, University of Victoria, Victoria, BC, Canada.]","institution_ids":["https://openalex.org/I212119943"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5002139930","display_name":"Wei Yu","orcid":"https://orcid.org/0000-0003-4522-7340"},"institutions":[{"id":"https://openalex.org/I4322298","display_name":"Towson University","ror":"https://ror.org/044w7a341","country_code":"US","type":"education","lineage":["https://openalex.org/I4322298"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Wei Yu","raw_affiliation_strings":["Department of Computer and Information Sciences, Towson University, Towson, MD, USA","Department of Computer & Information Sciences, Towson University, Towson, MD, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer and Information Sciences, Towson University, Towson, MD, USA","institution_ids":["https://openalex.org/I4322298"]},{"raw_affiliation_string":"Department of Computer & Information Sciences, Towson University, Towson, MD, USA","institution_ids":["https://openalex.org/I4322298"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5063375840","display_name":"Xinwen Fu","orcid":"https://orcid.org/0000-0003-2391-7789"},"institutions":[{"id":"https://openalex.org/I133738476","display_name":"University of Massachusetts Lowell","ror":"https://ror.org/03hamhx47","country_code":"US","type":"education","lineage":["https://openalex.org/I133738476"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Xinwen Fu","raw_affiliation_strings":["Department of Computer Science, University of Massachusetts Lowell, Lowell, MA, USA","Department of Computer Science, University of Massachusetts Lowell, Lowell MA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science, University of Massachusetts Lowell, Lowell, MA, USA","institution_ids":["https://openalex.org/I133738476"]},{"raw_affiliation_string":"Department of Computer Science, University of Massachusetts Lowell, Lowell MA, USA","institution_ids":["https://openalex.org/I133738476"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":5,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":6.6775,"has_fulltext":false,"cited_by_count":40,"citation_normalized_percentile":{"value":0.96635905,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":91,"max":99},"biblio":{"volume":"10","issue":"12","first_page":"2515","last_page":"2530"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/botnet","display_name":"Botnet","score":0.8465561866760254},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7858229875564575},{"id":"https://openalex.org/keywords/denial-of-service-attack","display_name":"Denial-of-service attack","score":0.7682124376296997},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.6806018948554993},{"id":"https://openalex.org/keywords/blocking","display_name":"Blocking (statistics)","score":0.6137683987617493},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.5780041813850403},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.5024890899658203},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.4674350321292877},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.2280559241771698},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.11047893762588501}],"concepts":[{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.8465561866760254},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7858229875564575},{"id":"https://openalex.org/C38822068","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Denial-of-service attack","level":3,"score":0.7682124376296997},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6806018948554993},{"id":"https://openalex.org/C144745244","wikidata":"https://www.wikidata.org/wiki/Q4927286","display_name":"Blocking (statistics)","level":2,"score":0.6137683987617493},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.5780041813850403},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.5024890899658203},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.4674350321292877},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.2280559241771698},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.11047893762588501}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/tifs.2015.2465934","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2015.2465934","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},{"id":"pmh:oai:CiteSeerX.psu:10.1.1.701.855","is_oa":false,"landing_page_url":"http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.701.855","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"http://cse.seu.edu.cn/PersonalPage/zhenling/publications_files/TIFS2015_TorWard_Discovery%2C_Blocking%2C_and_Traceback_of_Malicious_Traffic_over_Tor.pdf","raw_type":"text"}],"best_oa_location":null,"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions","score":0.7599999904632568}],"awards":[{"id":"https://openalex.org/G1284778368","display_name":"\u9762\u5411\u80fd\u8017\u4f18\u5316\u7684\u65e0\u7ebfMesh\u7f51\u7edc\u8282\u70b9\u90e8\u7f72\u4e0e\u8282\u80fd\u8c03\u5ea6\u673a\u5236\u7814\u7a76","funder_award_id":"61402104","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G2394323339","display_name":null,"funder_award_id":"1461060","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G2554326768","display_name":null,"funder_award_id":"61532013","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G3296749118","display_name":"\u57fa\u4e8e\u4fa7\u4fe1\u9053\u653b\u51fb\u7684\u533f\u540d\u901a\u4fe1\u6d41\u91cf\u8bc6\u522b\u3001\u5206\u6790\u548c\u8ffd\u8e2a\u6280\u672f\u7814\u7a76","funder_award_id":"61272054","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G3437670196","display_name":"\u4e91\u8ba1\u7b97\u73af\u5883\u4e0b\u9762\u5411\u79d1\u5b66\u5de5\u4f5c\u6d41\u5e94\u7528\u7684\u5f39\u6027\u8c03\u5ea6\u673a\u5236\u7814\u7a76","funder_award_id":"61202449","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G4380843134","display_name":null,"funder_award_id":"195819339","funder_id":"https://openalex.org/F4320334593","funder_display_name":"Natural Sciences and Engineering Research Council of Canada"},{"id":"https://openalex.org/G4398403904","display_name":null,"funder_award_id":"61502099","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G494818735","display_name":null,"funder_award_id":"1350145","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G4953858908","display_name":null,"funder_award_id":"61502098","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G6215822075","display_name":null,"funder_award_id":"1116644","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G6660056385","display_name":null,"funder_award_id":"CNS 1117175","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G6984860043","display_name":null,"funder_award_id":"61502100","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G7294379753","display_name":"\u57fa\u4e8e\u6307\u7eb9\u653b\u51fb\u7684\u7f51\u7edc\u5b9e\u4f53\u8bc6\u522b\u6280\u672f\u7814\u7a76","funder_award_id":"61572130","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G8152319438","display_name":null,"funder_award_id":"61320106007","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"},{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4320334593","display_name":"Natural Sciences and Engineering Research Council of Canada","ror":"https://ror.org/01h531d29"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":20,"referenced_works":["https://openalex.org/W1545050218","https://openalex.org/W1982647002","https://openalex.org/W1997697582","https://openalex.org/W2002080807","https://openalex.org/W2012574038","https://openalex.org/W2054228499","https://openalex.org/W2062173166","https://openalex.org/W2064138472","https://openalex.org/W2079842810","https://openalex.org/W2084330204","https://openalex.org/W2105486585","https://openalex.org/W2112178441","https://openalex.org/W2113341218","https://openalex.org/W2127295197","https://openalex.org/W2156410527","https://openalex.org/W2163007546","https://openalex.org/W2171318529","https://openalex.org/W2502616763","https://openalex.org/W6671829889","https://openalex.org/W6678969601"],"related_works":["https://openalex.org/W2294483539","https://openalex.org/W2378449000","https://openalex.org/W3187581118","https://openalex.org/W2929621094","https://openalex.org/W1996006176","https://openalex.org/W4285325964","https://openalex.org/W4230824443","https://openalex.org/W2038807247","https://openalex.org/W2097156747","https://openalex.org/W2559738661"],"abstract_inverted_index":{"Tor":[0,16,114,183],"is":[1,83],"a":[2,38,70,75,151,173],"popular":[3],"low-latency":[4],"anonymous":[5],"communication":[6],"system.":[7],"It":[8],"is,":[9],"however,":[10],"currently":[11],"abused":[12],"in":[13,69],"various":[14],"ways.":[15],"exit":[17,189],"routers":[18,185],"are":[19],"frequently":[20],"troubled":[21],"by":[22],"administrative":[23,60],"and":[24,36,45,59,62,87,95,103,134,160,186,196,204,212],"legal":[25,58],"complaints.":[26],"To":[27,143,164],"gain":[28],"an":[29],"insight":[30],"into":[31],"such":[32,73],"abuse,":[33],"we":[34,149,171],"designed":[35],"implemented":[37,150,172],"novel":[39],"system,":[40,153],"TorWard,":[41],"for":[42,209],"the":[43,46,64,101,104,145,202,205],"discovery":[44],"systematic":[47],"study":[48],"of":[49,106,147,168,207,214],"malicious":[50,89,169,215],"traffic":[51,115,121,126,181],"over":[52],"Tor.":[53],"The":[54],"system":[55,81],"can":[56,116],"avoid":[57],"complaints,":[61],"allows":[63],"investigation":[65],"to":[66,85,99,178,200],"be":[67],"performed":[68,92],"sensitive":[71],"environment":[72],"as":[74],"university":[76],"campus.":[77],"An":[78],"intrusion":[79],"detection":[80],"(IDS)":[82],"used":[84],"discover":[86],"classify":[88],"traffic.":[90,216],"We":[91,191],"comprehensive":[93],"analysis":[94,195],"extensive":[96,197],"real-world":[97,198],"experiments":[98,199],"validate":[100,201],"feasibility":[102,203],"effectiveness":[105,206],"TorWard.":[107],"Our":[108],"results":[109],"show":[110],"that":[111,187],"around":[112],"10%":[113],"trigger":[117],"IDS":[118,156],"alerts.":[119],"Malicious":[120],"includes":[122],"P2P":[123],"traffic,":[124,132,170],"malware":[125],"(e.g.,":[127],"botnet":[128,180],"traffic),":[129],"denial-of-service":[130],"attack":[131],"spam,":[133],"others.":[135],"Around":[136],"200":[137],"known":[138],"malwares":[139],"have":[140],"been":[141],"identified.":[142],"mitigate":[144],"abuse":[146],"Tor,":[148],"defense":[152],"which":[154],"processes":[155],"alerts,":[157],"tears":[158],"down,":[159],"blocks":[161],"suspect":[162],"connections.":[163],"facilitate":[165],"forensic":[166],"traceback":[167,213],"dual-tone":[174],"multi-frequency":[175],"signaling-based":[176],"approach":[177],"correlate":[179],"at":[182,188],"entry":[184],"routers.":[190],"carried":[192],"out":[193],"theoretical":[194],"TorWard":[208],"discovery,":[210],"blocking,":[211]},"counts_by_year":[{"year":2026,"cited_by_count":3},{"year":2025,"cited_by_count":1},{"year":2024,"cited_by_count":3},{"year":2023,"cited_by_count":3},{"year":2022,"cited_by_count":3},{"year":2021,"cited_by_count":3},{"year":2020,"cited_by_count":4},{"year":2019,"cited_by_count":5},{"year":2018,"cited_by_count":7},{"year":2017,"cited_by_count":3},{"year":2016,"cited_by_count":5}],"updated_date":"2026-06-17T08:01:34.144755","created_date":"2025-10-10T00:00:00"}