Poster: Towards a Secure and Practical System to Obfuscate Tor Network Traffic Minjae Seo†∗, Myoungsung You†∗, Taejune Park‡, Seungwon Shin†, and Jinwoo Kim§∗∗ †KAIST, ‡Chonnam National University, §Kwangwoon University Abstract—Tor (The Onion Routing) has emerged as a promis- ing open-source privacy network for providing anonymous communication in sensitive tasks, such as journalism and activism. However, it is also susceptible to deanonymization attacks, particularly flow correlation attacks, which iden- tify users by correlating unique traffic flow characteristics observed at the ingress and egress segments of a Tor con- nection. To mitigate these attacks, various traffic obfuscation techniques have been developed; however, they often suffer from bandwidth waste and CPU resource exhaustion, critical issues in the Tor ecosystem where efficient utilization of the limited, voluntarily-shared bandwidth and resource of nodes is crucial. In this paper, we propose ODIN, a Tor-tailored hardware-based security solution that hinders adversaries from launching flow correlation attacks. Unlike previous approaches that primarily added randomly crafted padding bytes to packets, ODIN innovatively minimizes bandwidth waste by slicing and reorganizing packets destined for the same server with the aid of the context of Tor circuits, effectively addressing the issue of wasted network resources. 1. Introduction Tor (The Onion Routing) is an open-source privacy network that enables Internet users, particularly those in contexts with active censorship such as journalists, ac- tivists, or whistle-blowers, to access anonymous online services. The Tor network is widely used, with over 3 million daily users and a total of 6,000 volunteer relay nodes transmitting terabytes of traffic every day. As the nature of Tor aims to facilitate anonymous communication for sensitive tasks, Tor is naturally a target for many deanonymization attacks. Among them, the flow correlation attack [8] is obviously the most powerful at- tack correlating unique characteristics of traffic flows (e.g., packet sizes, interval times) observed from the ingress and egress segments in a Tor connection. The pioneering research shows that it is effective for deanonymizing Tor clients and servers. For example, RAPTOR [10] achieved a 90% accuracy in deanonymizing user identity. Also, the state-of-the-art flow correlation of DeepCorr [9] offered a correlation accuracy of 96% even with shorter flow observations than previous methods required. In recognition of the threat posed by flow correlation attacks, several traffic obfuscation techniques [3], [4], [6] have been developed to mitigate them. However, these techniques are not well suited to the requirements of the Tor network due to the following issues: CPU Resource Exhaustion. Existing secret Tor relay nodes (e.g., bridge nodes [4]) or pluggable transports ∗Co-first authors, ∗∗Corresponding author (e.g., obfs4, meek [6]) are utilized to conceal the fact that clients are using the Tor network by randomizing packet bytes or disguising a Tor connection as other legitimate connections (e.g., Skype). However, these techniques rely on software-based systems to process individual packets, which significantly consumes CPU resources compared to using ordinary Tor relay nodes. Among them, it is partic- ularly crucial for exit nodes to ensure efficient resource utilization, as they play a vital role in maintaining unin- terrupted routing and communication in the Tor network. Tor Bandwidth Waste. Other techniques [5], [7] add crafted padding bytes to the original packets and control packet transmission timing to obfuscate the size and in- terval time of individual packets. However, the inclusion of padding bytes in these methods imposes additional burdens on individual packets and can waste Tor network bandwidth, particularly in situations where a limited num- ber of volunteer nodes are shared by many Tor clients. As a result, most existing obf