## 6 Experimental Evaluation and Discussion
### Closed World Evaluation
#### 6.1.2 For the Number of Entry ORs m  
We simulate users' loading webpages through different numbers of entry ORs in our experiments. We can observe that when fixing the slice variable **s** and increasing the number of entry ORs **m**, the WFP attack has almost no further validity, and the accuracy of the classifier is generally below 12% when m \(\geq\) 5. We believe that this reduced success rate of WFP attacks is due to the variation in split traces, which is generated implicitly by passing different resources through different paths. Considering the challenge that attackers face, and the uncertainty about the number of splits and entry ORs, we add a set of random number tests s\(\in\)[14; 19] in each set of experiments, respectively, and the success rate of the WFP attacks drops dramatically when attackers cannot determine the traffic pattern. Our experiments confirm our intuition that an attacker can barely execute a successful WFP attack if they have the ability to compromise one of the entry ORs and can observe the traffic going in and out of this relay. The size of the m value here involves a trade-off between privacy protection and the overhead of the WFP defense. If the value of **m** is too large, the traffic forwarded by each entry OR contains less valid information and also reduces the strength of the WFP attack. However, too large an **m** will result in reduced performance and excessive overhead for the Tor network. If **m** is too small, the defense against WFP attacks will be reduced. Therefore, **m** is a very important variable in the trade-off between privacy protection and overhead. In the previous experiment, we demonstrated the impact of the sub-paths **m** and slices **s** on defense effectiveness. In this study, it is also our concern how the splitting strategy of slices passes through the subcircuits. This means a splitting strategy to be adopted in order to make the traffic distribution highly diversified among the different paths loading the same page, thus hindering feature identification. In previous research work, the splitting strategy batched weighted random (BWR) was proposed to be effective [39]. The BWR \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**m** & **Undefended** & \multicolumn{4}{c}{**5**} \\ \hline
**s** & **Undefended** & **2** & **4** & **6** & **8** & **(2, 8)** \\ \hline k-NN & 92.45 & 5.66 & 3.78 & 2.41 & 1.12 & 2.38 \\ K-F & 95.80 & 16.28 & 8.79 & 4.65 & 3.14 & 5.63 \\ DF & 98.00 & 20.19 & 14.25 & 8.34 & 6.85 & 10.02 \\ Var-CNN & 98.80 & 23.32 & 15.57 & 9.98 & 7.19 & 11.24 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: The influence of a different number of slices and entry nodes on the classification accuracy. means creating a separate vector **w** for the loaded pages, where the probability of **n** entry ORs being selected is **m**, calculated from the Dirichlet distribution in m dimensions. Here, we use **m** to weigh the selection of the **n** entry ORs for the data transmission between the client and middle ORs and keep **n** updated during a single page load. We use the simulation simulator mentioned above to simulate data splitting by slicing the same dataset into different groups according to different splitting strategies and, after weighing the balance between the defensive capabilities and network overhead, setting the number of slices as s = 4 and, considering that the attacker only monitors one of the websites, we select one of the groups to be classified. We analyze and compare the results to further demonstrate that BWR, one of the four splitting strategies proposed in [39], is more defensive than the other splitting strategies, given that all the experimental conditions are the same. To learn more about the other three splitting strategies, please move to this paper to read about them in detail. There are two main reasons why BWR has the best defense. Firstly, the attacker is uncertain about the entry ORs (**n** is not regularly updated).