## 4 Architecture of Tor-Snowflake Traffic Identification Framework
### Snowflake Identification Based on DTLS Handshake Fingerprint  
Snowflake data transmission relies on WebRTC technology to establish communication tunnels, and it uses DTLS to achieve secure and reliable encrypted data transmission [33]. DTLS reuses a lot of existing TLS code in its design, making the two protocol structures similar, with comparable security mechanisms and protection levels, and ensuring reliable data delivery. Therefore, the method of applying classification for TLS encrypted traffic will also be applicable to the field of DTLS traffic identification to a certain extent.  
In this paper, we propose a Snowflake traffic identification method based on DTLS handshake fingerprinting information. This method is summarized from a previous study [26] on the analysis of the TLS used in Censorship Circumvention. The traditional TLS fingerprint-based application identification method usually constructs the extracted fingerprint information into fingerprint tags by the hash algorithm, and identifies the corresponding application by comparing it with a large database of fingerprint tags. We apply  
Figure 4: DNS requests in Tor-Snowflake communication.  
machine learning methods to construct models for the classification and identification of Snowflake by using the extracted fingerprint information as features.  
Based on the results of user pre-identification in the first step of the framework, we parse the filtered suspicious traffic, merge UDP flows according to the five-tuple information (srcIP, srcPort, dstIP, dstPort, Protocol), and extract DTLS message protocols from them. According to the DTLS handshake protocol layer format specification, we parse the DTLS handshake messages and extract fingerprint information from the Client Hello and Server Hello messages, respectively.  
For successfully parsed Client Hellos, we extracted the DTLS record version, record length, fragment offset, fragment length, length of cipher suites, list of cipher suites, length of extension, and list of extensions. The above fingerprint information was used to form the fingerprint characteristics of the DTLS Client Hello. In addition, the corresponding server response Server Hello message is parsed, allowing us to see what cipher suite and extensions were negotiated successfully. For each Server Hello message, we parsed the DTLS record version, record length, fragment offset, fragment length, chosen cipher suite, length of extension, and list of extensions. The DTLS handshake fingerprint information we selected to extract is shown in the Table 1.  
For the collected fingerprint features, we use the one-hot-encoding method for pre-processing, which uses N-bit status registers to encode N states. Each state has its own independent register bits, and at any moment, only one bit is valid, which is mostly used in the scenario of distance or similarity calculation between features when dealing with classification, regression, cluster, and other problems. Since with the machine learning Random Forest algorithm it is easy to compare the importance of the impact of different features on the classification results, we chose it to build a multi-classification model to implement Snowflake traffic identification and feature importance ranking based on DTLS fingerprint information features. The specific fingerprint recognition results and evaluation will be presented in Section 5.