## 4 Architecture of Tor-Snowflake Traffic Identification Framework
### Snowflake Tor HS Access Identification Based on DTLS Data Message  
By default, Tor provides anonymity protection for users but does not hide the identity of the servers they visit, so the IP address information of a server can be obtained at the exit node or at a location between the server and the exit node. Tor addresses the potential privacy leaks faced by these service providers with the provision of hidden service. When a Tor user requests a resource that is provided by hidden service, instead of establishing a traditional three-hop circuit to the service provider, the Tor user establishes a connection to rendezvous points through a series of steps, and relays traffic through that node to access the hidden service. It shows that there is a significant difference in circuit construction between Tor hidden service activities and general access activities, and this difference is mainly reflected in the features of transmitted messages. Tor-Snowflake still follows the communication and forwarding mechanism of Tor. The Snowflake client just establishes communication tunnels with volunteer nodes outside the censorship area with the help of WebRTC technology to achieve access to the Tor \begin{table}
\begin{tabular}{c c c} \hline \hline
**Feature** & **Client Hello** & **Server Hello** \\ \hline DTLS record version & ✓ & ✓ \\ Record length & ✓ & ✓ \\ Fragment offset & ✓ & ✓ \\ Fragment length & ✓ & ✓ \\ Cipher suite length & ✓ & ✓ \\ Cipher suites & ✓ & ✓ \\ Extension Length & ✓ & ✓ \\ Extensions & ✓ & ✓ \\ Cipher suit chosen & & ✓ \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Features selected from DTLS handshake process. network, which neither changes the operation mechanism of Tor nor affects the circuit establishment process. Therefore, Snowflake communication is the upper layer protocol of Tor communication, similar to the relationship between the UDP protocol and IP protocol. After Snowflake completes the establishment of the communication tunnel with the peer point, it encapsulates the Tor communication data messages generated by the client in the data-channel of WebRTC for transmission. Since there is a difference in circuit establishment between Tor HS activities and general access activities, we analyze the messages in the DTLS data transmission phase of Snowflake PT. We propose a method based on the accumulative total payload sampling of messages in the DTLS data transmission phase, where a fixed number of m additional features are extracted from the accumulated message payload length and combined with common traffic classification features such as statistical characteristics of the communication packets, statistical characteristics of the packets interval time, input-output message number ratio and size ratio to identify Tor- snowflake HS access activities. Since the circuit establishment process exists only at the beginning of the DTLS data transmission phase of Snowflake traffic, the first n messages of this phase are extracted and our proposed feature selection method is performed. Based on the Snowflake flow identified in the previous subsection, the DTLS data transmission message is parsed to extract the encrypted payload length of the message. The constituted length sequence S = (\(p_{1}\),..., \(p_{\rm m}\)). \(|p_{\rm i}|\) indicates the payload length of messages, and the positive or negative value of \(p\) indicates the transmission direction of messages, when \(p_{\rm i}>0\) indicates an output message, and \(p_{\rm i}<0\) indicates an input message. The accumulative message payload in the data transmission phase can be expressed as A (S) = ((0,0), (\(\rm i_{1}\), \(\rm a_{1}\)), (\(\rm i_{N}\),\(\rm a_{N}\))), where \(\rm i_{N}\) indicates the message location index, \(\rm a_{1}=p_{1}\), \(\rm a_{i}=a_{i-1}+p_{i}\) for i = 2,..., N. We obtain m equally spaced sampling points A\({}_{1}\),..., A\({}_{\rm m}\) by sampling in the segmented linear interpolation function of the A sequence.