Tor is the most well-known tool for circumventing censorship. Unfortunately, Tor traffic has been shown to be detectable using deep-packet inspection. WebRTC is a popular web frame-work that enables browser-to-browser connections. Snowflake is a novel pluggable transport that leverages WebRTC to connect Tor clients to the Tor network. In theory, Snowflake was created to be indistinguishable from other WebRTC services. In this paper, we evaluate the indistinguishability of Snowflake. We collect over 6,500 DTLS handshakes from Snowflake, Facebook Messenger, Google Hangouts, and Discord WebRTC connections and show that Snowflake is identifiable among these applications with 100% accuracy. We show that several features, including the extensions offered and the number of packets in the handshake, distinguish Snowflake among these services. Finally, we suggest recommendations for improving identification resistance in Snowflake. We have made the dataset publicly available.
翻译：托尔是最著名的规避审查工具。 不幸的是, 托尔交通已被证明可以使用深片检查来检测。 WebRTC 是一个受欢迎的网络框架工作, 使浏览器到浏览器连接。 Snowflake 是一种新型的插件运输, 利用 WebRTC 将托尔客户端连接到 Tor 网络。 从理论上讲, 创建雪花是无法与其它 WebRTC 服务区分的。 我们在本文件中评估了雪花的不可分性。 我们从 Snowflake、 Facebook 送信者、 Google Hangout 和 Discoord WebRTC 连接中收集了 6, 500 多 DTLS 握手, 并显示这些应用程序中可以百分之百地识别雪花 。 我们展示了几个特性, 包括所提供的扩展和手握的包数, 区别了这些服务中的雪花。 最后, 我们建议如何改善雪花中的识别阻力。 我们已经公开了数据集 。
相关内容
微信扫码咨询专知VIP会员