Locating tor's hidden service clients based on protocol feature

Tor is a low-latency anonymous communication system, which is designed not only to protect personal privacy, but also to protect the privacy of the server. Tor allows third parties or individuals to provide web service anonymously so that web service providers can hide their real IP addresses in the network, which is called hidden service. In this paper, we propose a scheme that can locate the real IP address of clients of hidden service based on protocol feature in Tor network, which can crack the users' anonymity of hidden service. In our scheme, we control the hidden service to send a certain amount of cells which has a 0 stream ID after receiving begin stream cell (sent by client) on a circuit, all of these cells will be dropped after arriving client side. Once our controlled entry onion routers detect this number of cells after the circuit between user and hidden service building, we can confirm the IP address of the client. Compared with other attacks, our scheme is simpler, and will not take the client's attention. We conduct extensive analysis and experiments over Tor network in the simulation environment to demonstrate the feasibility and effectiveness of our scheme.