## 2 Related Work  
In this section, we first introduce the related work on Tor traffic analysis, and then describe the existing research on Tor PT traffic identification. We briefly introduce them as follows. 1. Tor traffic analysis  
Many works have been devoted to Tor traffic analysis in recent years. They attempt to determine whether users are using Tor and what service or content they are accessing by passively observing user traffic. [PERSON] et al. [14] presented a time-based method to characterize and identify Tor traffic within a flow. They confirm that time-based characteristics of traffic can be used to characterize Tor traffic and efficiently distinguish between different Tor application traffic. [PERSON] et al. [15] used the hierarchical classification (HC) framework on the public anonymous dataset Anon17 [16] to classify three famous anonymous tools' traffic (i.e., Tor, I2P, and JonDonym). They conducted experiments to analyze traffic at different grain from three different levels, and the highest level of application category obtained a gain of F-measure up to +4.5% with respect to a similar work [17]. WF (Website Fingerprint) has also become an important branch of Tor traffic analysis. [PERSON] et al. [18] proposed a novel website fingerprinting attack in an open-world scenario, and tested it on a huge real-world representative dataset. Their approach has a better performance than all state-of-the-art methods in classification accuracy and consumes less computational resources. They explored the limits of WF at the Internet scale. [PERSON] et al. [19] proposed a novel deep learning (DL)-based WF attack method, which can automatically perform the feature engineering process. This DL-based WF approach overcomes the failure of traditional manual feature engineering to cope with the new changes introduced to the Tor network. They evaluated the method on the largest ever dataset of WF and found that the best DL model performed with over 2% higher accuracy than the state-of-the-art attack method [18]. In another work, [PERSON] et al. [20] leveraged a convolutional neural network to construct a WF attack model and evaluated it against state-of-art defenses (e.g., WTF-PAD and Walkie-Talkie). Results showed over 98% accuracy on non-defended Tor traffic, and achieved more than 90% accuracy when employing WTF-PAD [21]. However, only 49.7% accuracy is achieved when applying Walkie-Talkie [22]. This method is still effective in open-world scenarios. 2. Tor PT traffic identification  
Traffic analysis brings a huge threat to Tor's anonymity; therefore, Tor has developed some censorship-resistant PT tools to help people against traffic attacks in the Tor network. Many efforts have attempted to de-anonymize PT traffic. [PERSON] et al. [23] presented the first comprehensive investigation of the detectability of five obfuscated traffic PT tools used in Tor and constructed a framework to show that censors can reliably identify these obfuscation tools with a sufficiently low false-positive rate. [PERSON] et al. [24] applied flow-based traffic analysis to evaluate the detecting performance of Tor PT. Adopting a C4.5 classifier, they found that the use of Tor PT was distinguishable, although some PTs changed the distribution of traffic or mimicked other traffic. [PERSON] et al. [7] studied PT-based Tor traffic identification under SSH-encrypted tunnels. The experimental results show that the availability and untraceability of tunneled Tor traffic can be reduced through traffic analysis based on machine learning algorithms. Obfs4 is one of the most popular PTs. Through the analysis of the obfs4 communication process, [PERSON] et al. [8] proposed a two-stage identification method combining coarse-grained filtering based on the randomness of message, time series of handshake phase and message length distribution with fine-grained identification based on the SVM algorithm for high-precision identification of Obfs4 traffic, and achieved 99% identification accuracy on their own experimental datasets.