Traffic Analysis Attacks on Tor: What Research Shows

Traffic analysis is the most studied theoretical attack against Tor. A global passive adversary that can observe both ends of a Tor circuit can correlate traffic patterns to deanonymize users.

How Correlation Attacks Work

An adversary monitoring both the entry and exit of a Tor circuit can match traffic patterns: packet timing, volume, and bursts. Even without decrypting content, the statistical correlation between entry and exit traffic can identify who is communicating with whom. Research papers demonstrate over 90% accuracy in lab conditions.

Real-World Feasibility

A true global passive adversary doesn't exist, but nation-states can observe significant portions of internet traffic. The NSA and GCHQ operate monitoring at major internet exchange points. The FBI has used traffic correlation in conjunction with compromised exit nodes. However, for most users, this attack requires resources beyond what typical adversaries deploy.

Mitigation

Use entry guards (Tor does this automatically). Avoid long-lived circuits for different activities. Use Tor bridges to obscure entry traffic from your ISP. Access .onion services (no exit node needed). Don't generate distinctive traffic patterns. Vanguards addon provides additional guard relay protection.