In recent years, web servers pay attention to privacy and anonymity protection and choose to rely on hidden service to avoid exposure of the real geographic locations. Several studies have confirmed that hidden service is vulnerable to flow correlation attacks, specifically, the attacker has the ability to synchronize the behavior of both sides of the communication after observing the flow for an extended period of time. However, since hidden service publish descriptor flow is transient behavioral traffic, automatically capturing and analyzing publish flow becomes a challenge. In this paper, our focus is the intelligent identification of the descriptor publishing flow. We propose a model for the descriptor publishing flow correlation attack (DPFCA). The model resolves the complex relationship between the circuit establishment flow and the publishing flow, and is able to intelligently process the sequence identification and content classification of the descriptor correlation flow of the existing version and tags. It is worth mentioning that the DPFCA is based on the automated homology comparison of the profile-hidden Markov model (PHMM). The descriptor publishing flow is converted to an amino symbol sequence and then compare with the known homologous sequence group in the library of Profile. The experimental results show that our model can achieve higher performance in terms of accuracy and reliability of transient flow identification compared with the traditional flow correlation attack model.

中文翻译：

---

基于profile-hidden markov模型的隐藏服务发布流程同源性比较

近年来，网络服务器注重隐私和匿名保护，选择依靠隐藏服务来避免真实地理位置的暴露。多项研究证实，隐藏服务容易受到流关联攻击，具体而言，攻击者在长时间观察流后，具有同步通信双方行为的能力。然而，由于隐藏服务发布描述符流是瞬态行为流量，自动捕获和分析发布流成为一个挑战。在本文中，我们的重点是描述符发布流程的智能识别。我们提出了一种描述符发布流相关攻击（DPFCA）模型。该模型解决了电路建立流程和发布流程之间的复杂关系，能够智能处理现有版本和标签的描述符关联流的序列识别和内容分类。值得一提的是，DPFCA 基于轮廓隐藏马尔可夫模型 (PHMM) 的自动同源性比较。描述符发布流程转换为氨基符号序列，然后与Profile库中已知的同源序列组进行比较。实验结果表明，与传统的流关联攻击模型相比，我们的模型在瞬态流识别的准确性和可靠性方面可以获得更高的性能。并且能够智能处理现有版本和标签的描述符关联流的序列识别和内容分类。值得一提的是，DPFCA 基于轮廓隐藏马尔可夫模型 (PHMM) 的自动同源性比较。描述符发布流程转换为氨基符号序列，然后与Profile库中已知的同源序列组进行比较。实验结果表明，与传统的流关联攻击模型相比，我们的模型在瞬态流识别的准确性和可靠性方面可以获得更高的性能。并且能够智能处理现有版本和标签的描述符关联流的序列识别和内容分类。值得一提的是，DPFCA 基于轮廓隐藏马尔可夫模型 (PHMM) 的自动同源性比较。描述符发布流程转换为氨基符号序列，然后与Profile库中已知的同源序列组进行比较。实验结果表明，与传统的流关联攻击模型相比，我们的模型在瞬态流识别的准确性和可靠性方面可以获得更高的性能。描述符发布流程转换为氨基符号序列，然后与Profile库中已知的同源序列组进行比较。实验结果表明，与传统的流关联攻击模型相比，我们的模型在瞬态流识别的准确性和可靠性方面可以获得更高的性能。描述符发布流程转换为氨基符号序列，然后与Profile库中已知的同源序列组进行比较。实验结果表明，与传统的流关联攻击模型相比，我们的模型在瞬态流识别的准确性和可靠性方面可以获得更高的性能。