## 5 Experiment Evaluation
### Data Collection  
When a client is configured to access the website with a specific obfuscator PT Snowflake, we capture the exchanged network traffic through the deployed automated network traffic collection environment to form the Snowflake traffic dataset. We used an experiment host with Ubuntu 22.04 and Tor 0.4.6.10 installed, which performed Snowflake general access activities and Snowflake hidden service access activities in a real network environment. We ran shell scripts and python scripts to control the state of the Tor service and automatically access web pages to generate traffic. We utilized the python scapy library to automate traffic collection. For each visit, we start capturing traffic before opening a new Tor-Snowflake process to access the web page, when we know from the status code that a web page has been fully accessed and successfully responded, we close the Tor and Snowflake processes after a delay of a few seconds (usually less than 5 s). Finally, we terminate the traffic capture process. Therefore, in our experiment, when a client visits a website, new connections and circuits will always be established. The traffic we capture contains the full Tor or Tor hidden service circuit establishment process for each access. In order to ensure that Snowflake successfully establishes a connection before web access and to improve the availability of the collected traffic, we use the Linux kernel function intify [34] to monitor the changes in the Tor log file notices.log, capture the signal that Snowflake PT successfully establishes a connection and use it as a flag to start web access.  
Some previous work [35] has argued that traffic generated by automated scripts is not as close to the real network environment as that generated by manual access. We take this into consideration. In a real network environment, people visiting web pages will display different operation latency and random behavior patterns. These are the weaknesses of automated scripts. We overcome these drawbacks by adding latency in writing scripts and by configuring the relevant parameters to mimic human behavior. Since training a credible and available classifier requires multiple visits to the web to generate large amounts of traffic, an automated script is a reliable choice.  
The set of addresses accessed in the experiment consists of hidden service domains and normal website domains. For the hidden service domains set, we randomly select 10,000 addresses from the websites previously obtained by our lab through the Tor hidden service address search engine. For the normal domains set, we extract the Alexa Top 10,000 websites to form the address set. Combining the impact of the prevailing network environment and the usage status of some websites, the effective traffic data generated by the experimentally accessed addresses are shown in Table 2.  
In order to compare and determine the effectiveness of the method for identifying Snowflake traffic based on DTLS handshake fingerprinting features, we combined DTLS handshake traffic from other WebRTC applications collected during the study of Snowflake indistinguishable by [PERSON] et al. [36] with randomly selected flows from the Snowflake traffic we collected, formed a new WebRTC DTLS handshake fingerprint dataset. The effective traffic flow of the dataset is shown in Table 3.