Tracing Tor Hidden Service Through Protocol Characteristics

Tor is a relay-based communication network that provides users with anonymous access to the Internet. Tor hidden services protect the identities of the content publishers to achieve anonymity and anti-censorship. However, hidden services are abused to conduct illegal activities, including hosting botnets and trading drugs. This paper proposes a tracing approach to locate illegal hidden services based on the Tor protocol characteristics, which allows a Tor client to embed a signal into a Tor circuit connecting with the illegal hidden service. Once the Tor node nearest to the the hidden service detects the signal, the identity of the hidden service can be revealed. Our approach is simple, powerful, and stable compared with previous methods. We implemented the approach and performed experiments over the Tor network, whose results show that our approach is feasible and effective, with 100% accuracy, 99.25% true positive rate, and zero false positive rate.