Tor network communication flow identification and analysis method

The invention relates to a Tor network communication flow identification and analysis method, and relates to the technical field of information security. Based on the principle that the Tor communication protocol can be identified by utilizing the characteristic that TLS in a Tor communication protocol is established in the transmission process, the data packet characteristic of the communicationprotocol is determined on the basis of the analysis of the TOR network communication protocol, and a protocol type is determined through characteristic extraction and comparison, so that the efficientTor network communication flow identification and analysis method is realized. 本发明涉及一种Tor网络通信流量识别分析方法，涉及信息安全技术领域。本发明基于利用Tor通信协议中TLS建立于传输过程的特征可实现对Tor通信协议的识别的原理，基于对TOR网络通信协议的分析，确定通信协议的数据包特征，通过特征提取及比对确定协议类型，实现了一种高效的Tor网络通信流量识别分析方法。