{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,17]],"date-time":"2026-06-17T13:05:17Z","timestamp":1781701517843,"version":"3.54.5"},"reference-count":55,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"12","license":[{"start":{"date-parts":[[2015,12,1]],"date-time":"2015-12-01T00:00:00Z","timestamp":1448928000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2015,12,1]],"date-time":"2015-12-01T00:00:00Z","timestamp":1448928000000},"content-version":"am","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2015,12,1]],"date-time":"2015-12-01T00:00:00Z","timestamp":1448928000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2015,12,1]],"date-time":"2015-12-01T00:00:00Z","timestamp":1448928000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"China National High Technology Research and Development Program","award":["2013AA013503"],"award-info":[{"award-number":["2013AA013503"]}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["61502100"],"award-info":[{"award-number":["61502100"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["61572130"],"award-info":[{"award-number":["61572130"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["61532013"],"award-info":[{"award-number":["61532013"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["61502098"],"award-info":[{"award-number":["61502098"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["61502099"],"award-info":[{"award-number":["61502099"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["61272054"],"award-info":[{"award-number":["61272054"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["61202449"],"award-info":[{"award-number":["61202449"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["61402104"],"award-info":[{"award-number":["61402104"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["61320106007"],"award-info":[{"award-number":["61320106007"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100000038","name":"Discovery from the Natural Sciences and Engineering Research Council of Canada","doi-asserted-by":"publisher","award":["195819339"],"award-info":[{"award-number":["195819339"]}],"id":[{"id":"10.13039\/501100000038","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000001","name":"U.S. National Science Foundation","doi-asserted-by":"publisher","award":["1461060"],"award-info":[{"award-number":["1461060"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000001","name":"U.S. National Science Foundation","doi-asserted-by":"publisher","award":["1116644"],"award-info":[{"award-number":["1116644"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000001","name":"U.S. National Science Foundation","doi-asserted-by":"publisher","award":["1350145"],"award-info":[{"award-number":["1350145"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000001","name":"U.S. National Science Foundation","doi-asserted-by":"publisher","award":["CNS 1117175"],"award-info":[{"award-number":["CNS 1117175"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Jiangsu Provincial Natural Science Foundation of China","award":["BK20150637"],"award-info":[{"award-number":["BK20150637"]}]},{"name":"Jiangsu Provincial Natural Science Foundation of China","award":["BK20150628"],"award-info":[{"award-number":["BK20150628"]}]},{"name":"Jiangsu Provincial Natural Science Foundation of China","award":["BK20150629"],"award-info":[{"award-number":["BK20150629"]}]},{"name":"Jiangsu Provincial Key Technology R&D Program","award":["BE2014603"],"award-info":[{"award-number":["BE2014603"]}]},{"name":"Jiangsu Provincial Key Laboratory of Network and Information Security","award":["BM2003201"],"award-info":[{"award-number":["BM2003201"]}]},{"name":"Key Laboratory of Computer Network and Information Integration of Ministry of Education of China","award":["93K-9"],"award-info":[{"award-number":["93K-9"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2015,12]]},"DOI":"10.1109\/tifs.2015.2465934","type":"journal-article","created":{"date-parts":[[2015,8,13]],"date-time":"2015-08-13T16:00:15Z","timestamp":1439481615000},"page":"2515-2530","source":"Crossref","is-referenced-by-count":29,"title":["TorWard: Discovery, Blocking, and Traceback of Malicious Traffic Over Tor"],"prefix":"10.1109","volume":"10","author":[{"given":"Zhen","family":"Ling","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Junzhou","family":"Luo","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Kui","family":"Wu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Wei","family":"Yu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xinwen","family":"Fu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref39","year":"2015","journal-title":"CI Army"},{"key":"ref38","year":"2015","journal-title":"OpenBL org—Abuse Reporting and Blacklisting"},{"key":"ref33","author":"tigas","year":"2015","journal-title":"Onion Browser"},{"key":"ref32","year":"2015","journal-title":"Tor on Android"},{"key":"ref31","year":"2015","journal-title":"TShark"},{"key":"ref30","year":"2015","journal-title":"nDPI—Open and Extensible LGPLv3 Deep Packet Inspection Library"},{"key":"ref37","author":"gerzo","year":"2012","journal-title":"Brute Force Blocker"},{"key":"ref36","year":"2015","journal-title":"Spamhaus"},{"key":"ref35","year":"2015","journal-title":"DShield"},{"key":"ref34","author":"dunham","year":"2007","journal-title":"The Russian Business Network"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/INFCOM.2012.6195627"},{"key":"ref27","year":"2008","journal-title":"Basic Analysis and Security Engine (BASE) Project"},{"key":"ref29","year":"2015","journal-title":"Tor Network Status"},{"key":"ref2","doi-asserted-by":"crossref","first-page":"213","DOI":"10.1145\/2488388.2488408","article-title":"Traveling the silk road: A measurement analysis of a large anonymous online marketplace","author":"christin","year":"2013","journal-title":"Proc 22nd Int World Wide Web Conf (WWW)"},{"key":"ref1","year":"2015","journal-title":"Tor Anonymity Online"},{"key":"ref20","year":"2015","journal-title":"Freenet"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2012.2197392"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2011.2173678"},{"key":"ref24","year":"2015","journal-title":"Suricata"},{"key":"ref23","year":"2015","journal-title":"Transparently Routing Traffic Through Tor"},{"key":"ref26","year":"2015","journal-title":"Barnyard2"},{"key":"ref25","year":"2015","journal-title":"Emerging Threats"},{"key":"ref50","first-page":"183","article-title":"Low-cost traffic analysis of Tor","author":"murdoch","year":"2006","journal-title":"Proc IEEE Secur Privacy Symp (S&P)"},{"key":"ref51","first-page":"11","article-title":"Low-resource routing attacks against anonymous systems","author":"bauer","year":"2007","journal-title":"Proc ACM Workshop Privacy Electron Soc (WPES)"},{"key":"ref55","author":"dingledine","year":"2015","journal-title":"Tor path specification"},{"key":"ref54","year":"2015","journal-title":"mIRC Internet Relay Chat Client"},{"key":"ref53","year":"2015","journal-title":"PlanetLab An Open Platform for Developing Deploying and Accessing Planetary-Scale Services"},{"key":"ref52","first-page":"578","article-title":"A new cell-counting-based attack against Tor","author":"ling","year":"2009","journal-title":"Proc 16th ACM CCS"},{"key":"ref10","year":"2012","journal-title":"IAmA A Malware Coder and Botnet Operator AMA"},{"key":"ref11","author":"guarnieri","year":"2012","journal-title":"Skynet a Tor-powered Botnet Straight from Reddit"},{"key":"ref40","year":"2015","journal-title":"SNORT Users Manual 2 9 5 Snort Default Classifications"},{"key":"ref12","year":"2012","journal-title":"Dec 2012 Skynet Tor Botnet\/Trojan Tbot Samples"},{"key":"ref13","author":"matrosov","year":"2013","journal-title":"The Rise of TOR-based Botnets"},{"key":"ref14","author":"danchev","year":"2013","journal-title":"Cybercriminals Experiment with Tor-based C&C ring-3-rootkit Empowered SPDY Form Grabbing Malware Bot"},{"key":"ref15","first-page":"100","article-title":"Locating hidden servers","author":"\u00f8verlier","year":"2006","journal-title":"Proc IEEE Secur Privacy Symp (S&P)"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1145\/1180405.1180410"},{"key":"ref17","first-page":"509","article-title":"Application-level attack against Tor’s hidden service","author":"zhang","year":"2011","journal-title":"Proc 6th Int Conf Pervasive Comput Appl"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2013.15"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/INFCOM.2013.6566978"},{"key":"ref4","author":"storm","year":"2011","journal-title":"Fingered by IP Does It Take Chutzpah to Run a Tor Exit Relay?"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/INFCOM.2013.6566894"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/NSS.2010.47"},{"key":"ref5","doi-asserted-by":"crossref","first-page":"63","DOI":"10.1007\/978-3-540-70630-4_5","article-title":"Shining light in dark places: Understanding the Tor network","author":"mccoy","year":"2008","journal-title":"Proc 8th Int Symp Privacy Enhancing Technol (PETS)"},{"key":"ref8","author":"brown","year":"2010","journal-title":"Resilient Botnet Command and Control with Tor"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM.2014.6848074"},{"key":"ref49","year":"2015","journal-title":"Wikipedia Dual-tone Multi-frequency Signaling"},{"key":"ref9","year":"2015","journal-title":"Tor2web Visit Anonymous Websites"},{"key":"ref46","year":"2015","journal-title":"UnrealIRCd"},{"key":"ref45","year":"2015","journal-title":"TSOCKS—A Transparent SOCKS Proxying Library"},{"key":"ref48","year":"2015","journal-title":"Tor Control Protocol Specification"},{"key":"ref47","year":"2015","journal-title":"Sourcefire Vulnerability Research Team (vrt)"},{"key":"ref42","year":"2011","journal-title":"A Guide to SpyEye C&C Messages"},{"key":"ref41","year":"2015","journal-title":"SHADOW"},{"key":"ref44","author":"eriksson","year":"2015","journal-title":"Pen"},{"key":"ref43","year":"2015","journal-title":"Mt Gox"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"http:\/\/ieeexplore.ieee.org\/ielaam\/10206\/7277179\/7182328-aam.pdf","content-type":"application\/pdf","content-version":"am","intended-application":"syndication"},{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/10206\/7277179\/07182328.pdf?arnumber=7182328","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,5,20]],"date-time":"2022-05-20T11:25:44Z","timestamp":1653045944000},"score":1,"resource":{"primary":{"URL":"http:\/\/ieeexplore.ieee.org\/document\/7182328\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2015,12]]},"references-count":55,"journal-issue":{"issue":"12"},"URL":"https:\/\/doi.org\/10.1109\/tifs.2015.2465934","relation":{},"ISSN":["1556-6013","1556-6021"],"issn-type":[{"value":"1556-6013","type":"print"},{"value":"1556-6021","type":"electronic"}],"subject":[],"published":{"date-parts":[[2015,12]]}}}