{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,25]],"date-time":"2026-06-25T20:46:41Z","timestamp":1782420401118,"version":"3.54.5"},"reference-count":79,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Open J. Commun. Soc."],"published-print":{"date-parts":[[2026]]},"DOI":"10.1109\/ojcoms.2026.3705147","type":"journal-article","created":{"date-parts":[[2026,6,18]],"date-time":"2026-06-18T20:13:35Z","timestamp":1781813615000},"page":"6723-6740","source":"Crossref","is-referenced-by-count":0,"title":["Detecting Tor Snowflake as Anomalous WebRTC Traffic Under Extreme Class Imbalance"],"prefix":"10.1109","volume":"7","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-5977-2035","authenticated-orcid":false,"given":"Ban","family":"Alomar","sequence":"first","affiliation":[{"name":"Higher Colleges of Technology, Dubai, United Arab Emirates"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8686-8975","authenticated-orcid":false,"given":"Zouheir","family":"Trabelsi","sequence":"additional","affiliation":[{"name":"United Arab Emirates University, Al Ain, United Arab Emirates"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","first-page":"335","article-title":"Censorship-circumvention tools and pluggable transports","volume":"6","author":"Bateyko","year":"2022","journal-title":"Georgetown Law Technol. Rev."},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23511"},{"key":"ref3","volume-title":"Snowflake Bridge Metrics 2023 Year in Review","author":"Fifield","year":"2024"},{"key":"ref4","volume-title":"2022 Year in Review","author":"Nordberg","year":"2022"},{"key":"ref5","first-page":"2635","article-title":"Snowflake, a censorship circumvention system using temporary WebRTC proxies","volume-title":"Proc. 33rd USENIX Secur. Symp. (USENIX Secur.)","author":"Bocovich"},{"key":"ref6","first-page":"705","article-title":"IRBlock: A large-scale measurement study of the Great Firewall of Iran","volume-title":"Proc. 34th USENIX Secur. Symp. (USENIX Secur.)","author":"Tai"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2018.2883147"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/MCOM.2019.1800819"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2022.3208196"},{"issue":"1","key":"ref10","doi-asserted-by":"crossref","first-page":"622","DOI":"10.3390\/app13010622","article-title":"F-ACCUMUL: A protocol fingerprint and accumulative payload length sample-based tor-snowflake traffic-identifying framework","volume":"13","author":"Chen","year":"2023","journal-title":"Appl. Sci."},{"key":"ref11","article-title":"Evaluating snowflake as an indistinguishable censorship circumvention tool","author":"MacMillan","year":"2020","journal-title":"arXiv:2008.03254"},{"key":"ref12","first-page":"2689","article-title":"Fingerprinting obfuscated proxy traffic with encapsulated TLS handshakes","volume-title":"Proc. 33rd USENIX Secur. Symp. (USENIX Secur.)","author":"Xue"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1007\/978-981-99-9247-8_40"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2024.23394"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1145\/357830.357849"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1145\/1851182.1851194"},{"key":"ref17","article-title":"Fingerprintability of WebRTC","author":"Fifield","year":"2016","journal-title":"arXiv:1605.08805"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1038\/s41597-024-03927-4"},{"key":"ref19","first-page":"4393","article-title":"Deep one-class classification","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Ruff"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23204"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1145\/1541880.1541882"},{"issue":"1","key":"ref22","first-page":"37","article-title":"Running a high-performance pluggable transports tor bridge","volume-title":"Proc. 13th USENIX Workshop Free Open Commun. Internet (FOCI)","volume":"2023","author":"Fifield","year":"2023"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1145\/3658644.3690220"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1515\/popets-2015-0009"},{"key":"ref25","first-page":"1","article-title":"Fingerprint-resistant DTLS for usage in Snowflake","author":"Midtlien","year":"2025","journal-title":"Free Open Commun. Internet (FOCI) 2025(2)"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813715"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/ICDIS.2019.00036"},{"key":"ref28","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2024.103976","article-title":"DomEye: Detecting network covert channel of domain fronting with throughput fluctuation","volume":"144","author":"Xie","year":"2024","journal-title":"Comput. Secur."},{"key":"ref29","article-title":"Differential degradation vulnerabilities in censorship circumvention systems","author":"Sun","year":"2024","journal-title":"arXiv:2409.06247"},{"key":"ref30","doi-asserted-by":"crossref","DOI":"10.1016\/j.comnet.2025.111586","article-title":"Detection of tor network obfuscated traffic using bidirectional generative adversarial network","volume":"271","author":"AlOmar","year":"2025","journal-title":"Comput. Netw."},{"key":"ref31","volume-title":"SecureDrop Directory","year":"2025"},{"key":"ref32","volume-title":"GlobaLeaks: Open-Source Whistleblowing Software","year":"2025"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1145\/3618257.3624817"},{"key":"ref34","volume-title":"Interactive Connectivity Establishment (ICE): A Protocol for Network Address Translator (NAT) Traversal for Offer\/Answer Protocols","author":"Rosenberg","year":"2010"},{"key":"ref35","first-page":"1","article-title":"Turbo tunnel, a good way to design censorship circumvention protocols","volume-title":"Proc. 10th USENIX Workshop Free Open Commun. Internet (FOCI)","author":"Fifield"},{"key":"ref36","first-page":"2653","article-title":"How the great firewall of China detects and blocks fully encrypted traffic","volume-title":"Proc. 32nd USENIX Secur. Symp. (USENIX Secur.)","author":"Wu"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1162\/089976601750264965"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1145\/3439950"},{"key":"ref39","volume-title":"Stem: Python Controller Library for Tor","author":"Johnson","year":"2011"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1145\/2517840.2517851"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23105"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.5220\/0006105602530262"},{"key":"ref43","volume-title":"The Transport Layer Security (TLS) Protocol Version 1.2","author":"Rescorla","year":"2008"},{"key":"ref44","doi-asserted-by":"crossref","DOI":"10.17487\/rfc6347","volume-title":"Datagram Transport Layer Security Version 1.2","author":"Rescorla","year":"2012"},{"key":"ref45","doi-asserted-by":"crossref","DOI":"10.17487\/RFC8489","volume-title":"Session Traversal Utilities for NAT (STUN)","author":"Petit-Huguenin","year":"2020"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.21236\/ADA465464"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-20305-3_14"},{"key":"ref48","doi-asserted-by":"crossref","DOI":"10.17487\/RFC8834","volume-title":"Media Transport and Use of RTP in WebRTC","author":"Perkins","year":"2021"},{"key":"ref49","volume-title":"The Secure Real-Time Transport Protocol (SRTP)","author":"Carrara","year":"2004"},{"key":"ref50","volume-title":"Scapy: Packet Crafting for Python","author":"Biondi","year":"2024"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/SURV.2009.090304"},{"key":"ref52","doi-asserted-by":"crossref","first-page":"411","DOI":"10.1016\/j.cose.2017.11.004","article-title":"UGR-16: A new dataset for the evaluation of cyclostationarity-based network IDSs","volume":"73","author":"Maci\u00e1-Fern\u00e1ndez","year":"2018","journal-title":"Comput. Secur."},{"key":"ref53","volume-title":"Selenium WebDriver: Browser Automation Framework","author":"Huggins","year":"2018"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1145\/3199524.3199534"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1016\/j.adhoc.2013.05.003"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1145\/2910017.2910605"},{"key":"ref57","first-page":"407","article-title":"Characterization of encrypted and VPN traffic using time-related features","volume-title":"Proc. 2nd Int. Conf. Inf. Syst. Secur. Privacy","author":"Draper-Gil"},{"key":"ref58","volume-title":"TCPDUMP: A Command-Line Packet Analyzer","author":"Jacobson","year":"1988"},{"key":"ref59","doi-asserted-by":"crossref","DOI":"10.17487\/rfc5764","volume-title":"Datagram Transport Layer Security (DTLS) Extension to Establish Keys for the Secure Real-time Transport Protocol (SRTP)","author":"McGrew","year":"2010"},{"key":"ref60","doi-asserted-by":"crossref","DOI":"10.17487\/RFC8839","volume-title":"Session Description Protocol (SDP) Offer\/Answer Procedures for Interactive Connectivity Establishment (ICE)","author":"Petit-Huguenin","year":"2021"},{"key":"ref61","doi-asserted-by":"crossref","DOI":"10.17487\/RFC9147","volume-title":"The Datagram Transport Layer Security (DTLS) Protocol Version 1.3","author":"Rescorla","year":"2022"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1109\/tnet.2022.3171467"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1145\/2736084.2736094"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1145\/3730567.3764438"},{"key":"ref65","doi-asserted-by":"crossref","DOI":"10.17487\/RFC7539","volume-title":"ChaCha20 and Poly1305 for IETF Protocols","author":"Nir","year":"2015"},{"key":"ref66","doi-asserted-by":"crossref","DOI":"10.17487\/rfc4568","volume-title":"Session Description Protocol (SDP) Security Descriptions for Media Streams","author":"Andreasen","year":"2006"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2017.27"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1109\/ICDM.2008.17"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1145\/342009.335388"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1126\/science.1127647"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.1312.6114"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-20893-6_39"},{"issue":"85","key":"ref73","first-page":"2825","article-title":"Scikit-learn: Machine learning in python","volume":"12","author":"Pedregosa","year":"2011","journal-title":"J. Mach. Learn. Res."},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1145\/2996758.2996768"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.2307\/2276774"},{"key":"ref76","volume-title":"DAVE Protocol White Paper: End-to-End Encryption for Discord Audio and Video","year":"2024"},{"key":"ref77","volume-title":"Research Safety Board","year":"2024"},{"key":"ref78","doi-asserted-by":"crossref","first-page":"253","DOI":"10.1016\/j.comnet.2004.03.033","article-title":"Prefix-preserving IP address anonymization: Measurement-based security evaluation and a new cryptography-based scheme","volume":"46","author":"Fan","year":"2004","journal-title":"Comput. Netw."},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1109\/ACSSC.2017.8335179"}],"container-title":["IEEE Open Journal of the Communications Society"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/8782661\/11343983\/11570227.pdf?arnumber=11570227","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,6,25]],"date-time":"2026-06-25T19:47:17Z","timestamp":1782416837000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11570227\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026]]},"references-count":79,"URL":"https:\/\/doi.org\/10.1109\/ojcoms.2026.3705147","relation":{},"ISSN":["2644-125X"],"issn-type":[{"value":"2644-125X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026]]}}}