An Approach for Detecting Anonymized Traffic: Orbot as Case Study
Mehdi Merouane · Automatic Control and Computer Sciences · 2022
Abstract— This work studies Orbot, an anonymous overlay network used to browse the Internet. Its ease of use has attracted all kinds of people, including ordinary Internet users who want to avoid being profiled to bypass censorship, government intelligence agencies that need to do operations on the Internet without being detected and companies who do not want to reveal information to their competitors. This article aims to study, analyze, and mostly identify the Orbot traffic, since much of it is used for illegal purposes. A method of identification of the anonymous network is established by examining the traffic to identify clues. The method used to detect the use of the Orbot application in the network is based on the creation of the rules with Snort IDS from the analysis of the packets in Wireshark analyzer. The encryption aspect of the flow of this anonymous network brings us to a deep packet inspection (DPI). A set of Snort rules were developed as a proof of concept for the proposed Orbot detection approach. Our traffic detection methodology has demonstrated that it can detect Orbot connections in real time.