## 5 Experimental Setup  
**Classification setup:** In our defense evaluation setup, we selected four of the most advanced website fingerprinting attack models, k-NN [12], k-fingerprinting [9], DF [7], and Var-CNN [5], which use everything from the k-nearest neighbors (k-NN) classifier to deep learning CNN, and DNN algorithms to classify Tor-loaded websites based on the external features they generate, and the analysis accuracy is more than 95%.  
**Simulated traffic:** In order to initially evaluate the defense efficiency and resistance to WF attacks in our research, we designed and implemented a simulator to simulate the traffic transmission process. The simulator can automatically split traffic into different groups according to the splitting policy. The simulator simulates the multiple paths formed between the user's OP and \(\mathbf{m}\) entry ORs when Tor loads a single page. When executing this scheme, we measure the delay generated by 1000 redundant splits and the recovery process separately, considering that the redundant splits cause delay. Since the delay is also generated in the real Tor network, we record the round-trip RTTs of cells entering the Tor network from different entry ORs and, reaching the destination through the same middle and exit OR, we send the same data through different subcircuits, measure 1000 RTTs cumulatively, and integrate the redundant slice delay and the real Tor network delay into the simulated paths to evaluate the defense time overhead.  
**Closed world and open world:** In the closed world, we evaluated our defense by collecting a dataset from the top 100 most popular websites ranked by Alexa [47]. First, we collected 100 undefended visited trajectories for each website to form a dataset called  
Figure 4: Transmission process.  
SMART-UNDEFENDED. Next, we started applying the defense system by collecting 100 defended access traces for each website. When selecting the splitting strategy, we referred to previous work [39], where we analyzed the experimental evaluation results of four different splitting strategies and compared them to select the optimal one, batched weighted random (BWR). The defended traffic patterns consist of the dataset called SMART-DEFENDED. To analyze our defense in the open world, 100 traffic patterns were recorded for each website based on the top 11,056 most popular websites of Alexa (excluding 100 websites in the closed world), and we called this dataset SMART-BACKGROUND. These traces were applied to the open world as background traffic for evaluating the defense. For all the experiments involved in this paper, each dataset collected was evenly divided into 10 copies and 10-fold cross-validation was used. The 10 copies of the dataset were run in both the training and testing phases, i.e., each phase was repeated 10 times. The test data can be selected as one of the 10 copies, the training dataset as the remaining 9 copies, and so on.  
In the actual Tor network, we built a number of entry and middle ORs, and we deployed a Tor client that performed traffic slicing, redundancy, splitting, and merging policies based on pre-defined policies. Our middle OR supported both the regular single-path circuit and multi-path circuits to allow flexibility in responding to user needs. The Tor client we deployed applied the automated approach proposed in previous work to collect all traces during the crawling of datasets as in the related work [6; 7; 8; 39]. For each page load, we used the tcpdump and Tor Browser 9.0.1 toolboxes to record the metadata, such as the TCP packet size and direction, and we applied the cell format we created. In addition, we removed traffic that showed page load errors or denied access, as attackers do not care about traffic with faulty page loading.