## 1 Introduction  
With the growing concern for privacy among Internet users, multiple anonymous techniques have been devoted to implement anonymous access, such as traffic obfuscation padding, multi-layer encryption, complex path transmission, and other means. Tor [1] is the most popular anonymous communication system, which owns 6114 active nodes with 2.93 million users and the data bandwidth transmitted of about 670 Gbit/s [2]. Tor also provides hidden services (HS) [1], which provides anonymity protection for the service side of the network using multi-hop reverse proxy or resource-sharing storage technology. The great anonymity provides a breeding ground for some illegal activities, such as drugs, firearms, human trade, hacking services, etc. [3], and poses a great obstacle to network regulation. To tackle the negative impact of Tor, researchers have begun to use traffic analysis extensively. Traffic analysis attempts to judge if a user is connecting to Tor or what service he is accessing by analyzing the user's traffic passively, which has become one of the approaches with the most potential to de-anonymize Tor [4]. In order to improve the anonymity and help users in censorship zones to access Tor, Tor introduced many integrate pluggable transport (PT) technologies, including Obfs4 [5], Meek [6], and so on. Users can obfuscate their traffic and secretly connect to Tor, thus getting around censorship. Several traffic analysis methods [7; 8; 9; 10] have achieved success on de-anonymizing PT, such as Obfs4, Meek, etc. Snowflake, based on WebRTC [11] technology, is the latest release of PT, which can establish an encrypted connection between the Tor client and Tor network, and few researchers have worked on it yet. WebRTC is an advanced open-source protocol framework that is widely used to build multimedia transmission tunnels between browsers, which is a peer-to-peer real-time communication. Some-censorship circumvention methods bypass the regulation by modifying and inputting users' data into multimedia protocol tunnels [12; 13], which have attracted increasing attention from researchers in recent years. WebRTC is widely used in many real-time communication applications (e.g., Facebook Messager, Google Hangouts, the gaming-focused chat Discord, etc. ), thus the censorship cannot block Snowflake by blocking instances of WebRTC communication. Snowflake is the latest release of Tor PT, which transmits traffic through the WebRTC data transmission channel and applies UDP as the transport layer framework protocol. As an emerging PT technology which effectively bypasses censorship, Snowflake is being used by an increasing number of users, but there is little research on traffic identification for it. Due to Snowflake being based on the UDP protocol for data transmission, and other popular Tor PT such as Obfs4 and Meek being based on TCP for data transmission, most of the existing traffic identification methods for Obfs4 and Meek do not apply to it. In addition, Snowflake relies on the WebRTC protocol framework for communication circuit construction, and the traffic generated will be largely confused with other WebRTC-based applications. These bring great challenges to the supervision. In this paper, we analyze the Snowflake protocol and propose a Tor-Snowflake traffic identification framework based on rule matching and DTLS handshake fingerprint features. Our framework can identify whether a user is accessing Tor with Snowflake, and can also make a determination about whether a user is accessing HS with Snowflake. The key contributions of this work are as follows:  
* By analyzing the communication process and system construction of the Snowflake, we propose the rule-matching technique to pre-identify snowflake traffic quickly. Beyond this, we raise an accurate Snowflake traffic identification method based on the DTLS handshake fingerprint. * Then, we propose a hidden service identification method based on cumulative length and statistical features.