See discussions, stats, and author profiles for this publication at: https://www.researchgate.

net/publication/313951935

Detecting and blocking onion router traffic using deep packet inspection

Conference Paper · September 2016

DOI: 10.1109/ELECSYM.2016.7861018

CITATIONS READS

10 5,388

3 authors, including:

Ferry Astika
Electronics Engineering Polytechnic Institute of Surabaya
31 PUBLICATIONS   80 CITATIONS   

SEE PROFILE

Some of the authors of this publication are also working on these related projects:

WSNPENS View project

Seri Edukasi SPBE View project

All content following this page was uploaded by Ferry Astika on 05 November 2017.

The user has requested enhancement of the downloaded file.

 Detecting and Blocking Onion Router Traffic Using
Deep Packet Inspection

Ferry Astika Saputra, Isbat Uzzin Nadhori, Balighani Fathul Barry

Department of Informatic and Computer Engineering
Politeknik Elektronika Negeri Surabaya
Surabaya, Indonesia
{ferryas,isbat}@pens.ac.id, [email protected]

Abstract—TOR (The Onion Router) has been a very popular TOR is basically created to help the internet users in their
anonymous proxy service. Since its first usage, TOR has been freedom of speech and privacy problems, including illegal
improved and become a very big network consisting more than traffic tapping, network surveillance that threatens their
7000 relays. Beside used by journalist, activist, and writer as a personal identity and privacy. TOR can also be used for
tool for their freedom of speech, its highly anonymous service is securing the user’s business or private activities, hiding their
also used by bot-nets, malware, distributed denial of service identity when executing freedom of speech, and some more
attacks, hidden services that sells illegal things, spams, and many good reasons, but just like the internet itself, TOR can also be
more. This paper will explain about a TOR usage detection misused to do some negative activities.
system by using deep packet inspection to extract and analyze its
network traffic. The result of the analysis will be used as a In Indonesia, various sites that have negative contents like
parameter for a proxy server to block TOR traffic in the pornography, online betting, malwares, are blocked by the
network. Using this network, detection, and blocking design, we government using simple DNS and IP address filtering. By
can block the Onion Router Traffic originated from TOR using TOR, people can easily bypassing those limitation
browser. enforced by the government or law.
Keywords—TOR; anonymity; detection; deep packet inspection Besides bypassing that blocking system, TOR can also be
used for other negative activities, for example, using its
I. INTRODUCTION anonym service to spread malwares and conduct illegal
hacking anonymously.
The internet has been developed, evolved, and also used by
so many positive activities, for example, by innovating our way TOR also has some special things that make it different
in information sharing and education, helps us in the field of with other anonymous service provider. Using TOR, we can
health and medical, or some other innovation that cannot be surf a hidden part of the internet that usually called the onion
listed one by one. But in other side, internet can also be websites. The onion websites are hidden websites which
misused to do negative or illegal activities, for example, illegal addresses ended with .onion. These websites are only
hacking and attacks, spreading malware or scam, pornography accessible by using TOR service. In this hidden part, we can
sites, narcotics and other illegal transaction, and many more. find so many example of negative websites, such as online
illegal drugs and narcotic store, illegal gun store, hire an
It is a common sense that when people are going to do these assassin service. All the information of these sites’ provider
activities, they will think about their privacy first, about their and users are flowing over TOR networks, so, all the
identity, whether they are doing these activities anonymously information are anonymous and really difficult to be traced.
or not, whether someone knows what they are doing or not.
Because of these reason, they will seek some technique or Just like the internet, the number of TOR users is also
method to gain more anonymity in the internet. Anonymity increasing year to year, according to the official data from the
cannot be obtained without using some special method or beginning of 2012 until the end of 2015 published in their
technique. There are many methods that can be used to obtain website, the average number of TOR users reached more than
various levels of anonymity in the internet, one of which is by 3.5 million users per day, with the highest number of more than
using TOR (The Onion Router). 11 million. This means that TOR is now commonly known and
used by the internet users.
The Onion Router, also known as TOR, is a free software
that could provide anonymity by using onion routing method.
Onion routing is a technique to redirect the user’s internet
traffic to certain servers, and hide their sent and received data
by wrapping them with some encryption layers. Those method
are used in order to anonymize the sender and the receiver
identity and data.
 introduced. The research was done by Roger Dingledine
et.al[1]. The architecture and work flow of this second
generation architecture was explained in detail in their research
publication.
Research in the field of TOR user detection has also been
done by Aanders Olaus Graneud from Gjøvik Universty
College Error! Reference source not found.. The research he
did was using the TLS protocol that used by TOR. He analyzed
the differences and anomalies of TOR’s TLS with other
ordinary TLS connection.
Anders used some methodology to identify and
Figure 1: TOR Daily User Graph 2012 – 2015 (Source: differentiate the implementation of TLS in TOR’s TLS
https://metrics.torproject.org). connection with other common TLS connection. From this
research, he found some anomaly in the TOR’s TLS
In this research, we will analyze the information of internet connection, for example, the port number used by TOR was
traffic in a network that consist of TOR user and ordinary 9001, but normal TLS usually uses 443. The combination of
internet users. The TOR users are using TOR with the TOR cipher suites that offered by TOR is always consist of a same
Browser Bundle software that provided free by Tor Project in combination.
its official website, and the detection will be done by using DPI But, along with the development of TOR, some anomaly
(Deep Packet Inspection) method. and characteristics found by Anders is not valid anymore and
DPI is a packet filtering method that extract the inside of cannot be used as a reference.
the packet, including header and its payload, and then
examines them. The examination method is varies according to III. HOW TOR WORKS
its function. It can be used to examine viruses, intrusions,
Now TOR has more than 6000 active relays that provided
spams, etc. and perform some action, or just log them to collect
free and also helped by volunteers from all over the world. All
their information data.
these relays are registered in some special and trusted servers,
DPI has been used by many users, from a small these servers are called directory servers.
community, corporations to governments. In the corporation
TOR relays communicate using fixed-size cells. Those cells
level, DPI usually used for preventing a virus or worm
size are 512 bytes, consist of header and payload. These cells
spreading through network, or preventing network attacks. In
classified into 2 categories, those are control cell and relay cell.
government level, DPI usually used for law enforcement, for
All communication that passed on the TOR traffic are executed
example to block some website access, filter bad traffic like
using TLS protocol to maintain its security and secrecy.
DDoS, spam, etc. and some other cases.
DPI has been implemented by many countries as their
method for traffic filtering, limitation, and law enforcement.
The most famous is China’s, it’s called The Great Firewall of
China. China uses DPI to enforce government blocking system.
The websites they block are including Google, Wikipedia, and
some VPN websites.
There are many software that can be used to implement Figure 2: TOR Control Cell and Relay Cell Structure
DPI. In this research, Bro-IDS will be used. Bro-IDS is an
event-based network security monitoring platform that could The header of TOR cell consist of a circuit identifier
trigger some action according to events that happening in the (CircID) to define its cell’s circuit, because in one TLS
network. connection, there can be more than one multiplexed circuit),
and a command (CMD) to bring a command to the destination.
II. RELATED WORKS This command is also the one that classified either the cell is a
Onion routing method began developed in 1995, and then control or a relay cell. Control cell commands are: padding,
the architecture of onion routing was published in 1996. The create (to create a connection), created (indicates connection
first generation of onion routing was designed to hide the created), and destroy (destroy a circuit).
routing information and minimalize the potential of traffic Relay cell has a similar structure, but it has a relay header
analysis on a network. The first architecture of onion routing placed before CMD. It contains stream identifier (StreamID),
was a virtual circuit that established by the user all the way to end-to-end checksum for integrity checking, and the length of
the destination. This method can be used in two-way direction, the relay payload. The relay commands are : relay data, relay
and can be used for any protocol that can adapt to use proxy. begin, relay end, relay teardown, relay connected, relay extend,
Over time, TOR improved by many developers, and in relay extended, relay truncate, relay truncated, relay sendme,
2004, second generation onion router (TOR) architecture was and relay drop.
 TOR works by first downloading the list of the relays circuit until the exit node. The exit node will then close the
provided in their respected directory servers. Then, after they connection between it and the destination.
downloaded all the relays information, TOR client will choose
some random relays to be a circuit. IV. SYSTEM DESIGN AND IMPLEMENTATION
The network topology that will be used in this research is
described in figure 4.

Figure 3: TOR Circuit Making Process. “OR” is abbreviation

of Onion Routing

After TOR chose some relays to be a circuit, TOR client

then send a control cell with a “create” command to the first
relay in the circuit, then, after the first relay received this
control cell, it will send a reply in the form of a control cell too,
to the TOR client with “created” message or command to
indicate that the connection to that relay has been established.
Along with this reply, the first relay will send its public key
that will be used for their communication encryption. Figure 4: Network Design
If there is more or another next relay in the circuit, then
TOR client will send a relay cell with a “relay extend” As seen on the figure 4, this system needs an Internet
command and the address destination of the next relay to the connection, one proxy server (in this research, we will use
first relay, then that first relay will receive it, and responded by Squid proxy), one IDS server (using Bro-IDS platform), and
sending a control cell with “create” command to the second client (the switch usage is optional, we can utilize it if more
relay. After the second relay received the create command, it than one client is exist).
will respond by sending a “created” command to the first relay
along with the second public key for TOR client to indicate A. Main Router
that the connection has been created. The first relay will Main router is the router that directly connected to the
receive it and send an “extended” relay cell along with the internet. In this research, MikroTik RB1100 X2AH is used as
second public key to TOR client. This process will be repeated the main router and it is connected to the internet using a public
until the last relay in the circuit. The last relay on the circuit IP.
will then be the exit node.
Then when opening a TCP stream, TOR client on the user’s B. Proxy Server
computer will send a relay cell with a begin command inside Proxy server is used for internet sharing and give access to
its CMD, then it will be translated by the relay and will be sent clients in the network. We use Squid3 as the proxyserver.
to next relay following the circuit until the last relay (the exit
node). When got a begin command, the exit node will make a C. Bro-IDS Server
three way handshake to the user’s destination address. After the
handshake successfully executed, the exit node will send a Bro-IDS[3] is a tool that can be used to analyze a network
relay cell with a connected command to indicate that the traffic in real-time. Bro-IDS uses deep packet inspection
connection is established. method to look inside the packet’s header and payload. Bro-
IDS’s scripts and actions are event-based, meaning that it can
After it’s all done, the user can finally send the converted triggered when there is some events happening in the network
data as a relay cell through the established circuit to the traffic, for example, we can set Bro-IDS to trigger or run some
destination. There will go the data transfer or request – actions or scripts when there is a new TCP connection
response activities through the circuit. established.
After all the request – response activities are done, the In this research, Bro-IDS will be the tool to analyze this
connection for the TCP stream will be closed. This process is network’s traffic, and try to differentiate TOR user traffic in the
done by sending a relay cell with a close command through the network. The traffic that went to Bro-IDS server is actually a
mirror from client-proxy server communication, using V. TOR CHARACTERISTICS
MikroTik’s port mirroring method. Bro-IDS can analyze network traffic in real-time, or use a
TCPdump file from a captured network traffic to be analyzed
D. Client offline. In the experiments that have been done in this research,
What we referred as a client here is not the TOR client, but the traffic that analyzed is a TCPdump file obtained by using
all the internet users in the network. All these clients are wireshark. The TCPdump file contains connections traffic of
connected and can access the internet using proxy server. TOR browser and a regular browser users.
Among these users, there will be some TOR users who use
TOR browser to surf the internet. These clients are the clients
that we will try to detect.

E. Flowchart
By using the tools that have been mentioned before, in this
research we use an algorithm that can be illustrated in figure 5.

Figure 6: Wireshark's TCPdump File

As mentioned before, all TOR network traffic is encrypted

using TLS. Because of this, we cannot see inside the packet
when TLS encryption is already established. To see the
anomalies and characteristics of TOR traffic, we can only
analyze its TLS connection establishment process.
There are two processes that will be analyzed. The first is
the process of connection establishment or usually called three-
way handshake between TOR users / clients and TOR network,
and the second is the process of making TLS protocol secure
session or usually called TLS handshake process.

A. Connection Establishment Process

Connection establishment process is the first step that will
be processed when a client wants to make a connection with a
server. Normally, this process will be done in 3 steps, usually
called three-way handshake.
Client Server
Figure 5: Blocking System Flowchart SYN

The input that will be analyzed by Bro-IDS is originated SYN,ACK

from client – proxy traffic, and mirrored to Bro-IDS server by
the router. Then all the information from those packets will be
extracted by Bro-IDS, and then analyzed to decide whether it ACK
has a TOR packet characteristics or not.
If it does not have any TOR characteristic, then there is no
action that will be triggered. But if there is a packet that has Figure 7: Three-way Handshake in TCP Connection
TOR characteristics, then some useful information from that Establishment Process
packet will be extracted and written into Bro-IDS log file. Bro-
IDS will also trigger 2 action after writing into log file, the first In a three-way handshake, the client will initiate the steps
is to write the destination IP address of that packet into a file by sending a TCP packet with SYN flag. After that, the server
which will be used as the proxy’s blocking reference. The which get the packet will respond by sending a TCP packet
second action is to reload the proxy so the newly added IP with SYN,ACK flag. And the last, the client sends a TCP
address will be blocked. packet with ACK flag to the server. Once this process is
completed, the connection has been made between the client extension, server with 1 IP can have more than 1
and the server, and they can start data transfer. hostname.
After comparing and analyzing the ClientHello message
When the header of TCP packets in TOR connection from the TOR Browser and ordinary browser, there are some
establishment and normal connection establishment compared, characteristics or differences found.
no anomalies were seen. TOR do a three-way handshake with The first characteristic is the combination of cipher suites.
SYN, SYN,ACK and ACK flags like other normal The combination of cipher suites offered by the browser / client
connections. is decided from a combination of the most known by the
browser, thus, a combination of cipher suites offered by TOR
B. TLS Session Establishment Browser is always the same. The second is in its "server_name"
TOR traffic uses TLS protocol as its encryption method. extension. Server name designated by TOR has a format that is
TLS is a replacement for SSL. Until now, TLS has evolved to always the same, that is "www.<randomstring>.com" or
version 1.2. "www.<randomstring>.net".
In general, websites that use TLS (HTTPS) have 2) Server Hello, Certificate, Server Hello Done
implemented TLS version 1.2, as well as TOR. TLS also have After getting the ClientHello, the server will provide
TLS handshake process which is a process for making a TLS answers by sending a ServerHello message. Like the one in the
session. The process can be illustrated in figure 8: TLS handshake illustration, the ServerHello message delivery
is also accompanied by a certificate and ServerHelloDone
delivery. The structure of each message is as follows:
• ServerHello :
o Handshake Type: Type of the handshake
message that sent.
o Length: The length of handshake message.
o Version: TLS version which the server
accepts to use.
o Random: An information consist of time and
28 random bytes.
o Session ID: ID of the last session that client
can and wants to use, so they do not have to
make a new session.
o Cipher Suite: Encryption algorithm that
accepted / chosen by the server, chosen from
Figure 8: TLS Handshake Process client’s cipher suites offer.
o Compression Method: Compression method
1) Client Hello that can be used.
Client Hello (ClientHello) is the first message sent that sebt o Extension: Extension or additional
by the client to start or initiate a TLS handshake. The structure information that delivered by server along
of the ClientHello messages are described below: with the message.
• Handshake Type: Type of the handshake message that • Certificate :
sent. o Version: Version of the certificate that used.
o Serial Number: Used to identify the
• Length: The length of handshake message.
certificate.
• Version: TLS version which the client wants / offers o Signature Algorithm: Algorithm that used to
to use. make the signature.
• Random: An information consist of time and 28 o Issuer: Name / information about who issued
random bytes. and verified the information in the
• Session ID: ID of the last session that client can and certificate.
wants to use, so they do not have to make a new o Validity: Date range of the certificate’s
session. valifity.
• Cipher Suites: List of encryption algorithm that o Subject: Subject of the destination server.
offered by the client. o Subject Public Key Info: Consist of public
• Compression Method: Compression method that can key and algorithm that used in that public
be used by the client to decrease bandwidth use. key encryption.
• Extension: Consist of some extension or additional o Extension: Extensions or additional
information that sent for the server. TLS protocol has information that provided.
so many extension that can be used, one of the • ServerHelloDone: This message indicates that the
important extensions is “server_name” that used for server hello is done, so the process can be continued
giving a name information for the server, which to next phase.
hostname is visited by the client. By using this
In packets sent by TOR in this process, discovered another
characteristic of TOR existed in the certificate. In the subject
and issuer information, TOR provides a string with the same In addition to writing them on the log file, Bro-IDS also
format as the "server_name" information in the client hello, write down the destination IP address of the detected TOR
which is "commonName=www.<randomstring>.com" or packet into a file that will be used by proxy to block.
"commonName=www.<randomstring>.net".
178.63.140.246
3) Client Key Exchange, Change Cipher Spec (Client), 93.115.84.143
94.242.228.174
Finished (Client) 90.155.23.218
Client makes master key using his and the server's random 213.246.56.62
key, and then encrypted with the server's public key with ...
algorithm that has been previously approved in the negotiation
process. In this process, no anomalies were seen when Figure 10: Squid Proxy Reference File
compared to a regular connection.
VII. CONCLUSION
4) Change Cipher Spec (Server), Finished (Server)
This process is the same as the previously performed TOR (The Onion Router) is a very famous anonymous
process by the client, indicating that traffic from the server will service. TOR works by passing network traffic into multiple
use the appropriate encryption algorithm that has been relays it provided, before leading to the actual destination.
negotiated. No anomalies were seen in this process. Additionally, TOR disguise its connection so it looks like an
ordinary HTTPS connection. Its communications that
implement TLS v1.2 protocol also makes it better at providing
VI. DETECTING AND BLOCKING anonymity for its users. Although the contents of its data traffic
TOR traffic characteristics obtained from the analysis is encrypted, TOR traffic still could be recognized by analyzing
described in Chapter V is used as parameters to detect TOR at its TLS handshake process and observe the certificate that
traffic. The detection is performed by using Bro-IDS tool. exist on that process, especially in the subject and issuer field
of the certificate. These characteristics that exist in TOR can be
The work flow of the script that used is when Bro-IDS used to detect if there is a TOR connection.
detects the presence of TLS / SSL Establishment, Bro-IDS will
perform a check on the TLS certificate, if it has the Using the network design, detection and blocking system
characteristics of TOR, Bro-IDS will write down some explained in this research, we can detect and block the Onion
information from the connection to torconn.log file in the logs Router traffic that originated from TOR browser.
folder belonging to Bro-IDS.
#separator \x09
REFERENCES
#set_separator , [1] Roger Dingledine, Nick Mathewson, and Paul Syverson. 2004. Tor: the
#empty_field (empty) second-generation onion router. In Proceedings of the 13th conference
#unset_field - on USENIX Security Symposium - Volume 13 (SSYM'04), Vol. 13.
#path torconn USENIX Association, Berkeley, CA, USA, 21-21.
#open 2016-05-05-02-23-39
#fields tor_ip source_ip ts
[2] Anders Olaus Granerud. Identifying TLS Abnormalities in TOR.,MA
#types string addr time Thesis of U. Gjøvik University College, 2010.
178.63.140.246 192.168.1.254 [3] Vern Paxson. 1999. Bro: a system for detecting network intruders in
1462429419.444899 real-time. Comput. Netw. 31, 23-24 (December 1999), 2435-2463.
93.115.84.143 192.168.1.254 DOI=http://dx.doi.org/10.1016/S1389-1286(99)00112-7.
1462429419.664135 [4] Jeff Moser, The First Few Milliseconds of an HTTPS Connection.,2009,
http://www.moserware.com/2009/06/first-few-milliseconds-of-
Figure 9: Log File Generated By Bro-IDS https.html
[5] Marek. Dissecting SSL handshake, 2012,
https://idea.popcount.org/2012-06-16-dissecting-ssl-handshake/
[6] Wikipedia. Transport Layer Security,
https://en.wikipedia.org/wiki/Transport_Layer_Security

View publication stats