Know Your Victim: Tor Browser Setting Identification via Network Traffic Analysis

Chun Ming Chang, Hsu Chun Hsiao, Timothy Lynar, Tatsuya Mori

Research output: Chapter in Book/Report/Conference proceedingConference contribution


Network traffic analysis (NTA) is widely researched to fingerprint users' behavior by analyzing network traffic with machine learning algorithms. It has introduced new lines of de-anonymizing attacks [1] in the Tor network, inclusive of Website Fingerprinting (WF) and Hidden Service Fingerprinting (HSF). Previous work [4] observed that the Tor browser version may affect network traffic and claimed that having identical browsing settings between the users and adversaries is one of the challenges in WF and HSF. Based on this observation, we propose a NTA method to identify users' browser settings in the Tor network. We confirm that browser settings have notable impacts on network traffic and create a classifier to identify the browser settings. The classifier can establish over 99% accuracy under the closed-world assumption. The open-world assumption results indicate classification success except for one security setting option. Last, we provide our observations and insights through feature analysis and changelog inspection.

Original languageEnglish
Title of host publicationWWW 2022 - Companion Proceedings of the Web Conference 2022
PublisherAssociation for Computing Machinery, Inc
Number of pages4
ISBN (Electronic)9781450391306
Publication statusPublished - 2022 Apr 25
Event31st ACM Web Conference, WWW 2022 - Virtual, Online, France
Duration: 2022 Apr 25 → …

Publication series

NameWWW 2022 - Companion Proceedings of the Web Conference 2022


Conference31st ACM Web Conference, WWW 2022
CityVirtual, Online
Period22/4/25 → …


  • Tor
  • anonymity
  • network traffic analysis
  • privacy

ASJC Scopus subject areas

  • Computer Networks and Communications
  • Software


Dive into the research topics of 'Know Your Victim: Tor Browser Setting Identification via Network Traffic Analysis'. Together they form a unique fingerprint.

Cite this