{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,8]],"date-time":"2026-04-08T02:46:35Z","timestamp":1775616395364,"version":"3.50.1"},"reference-count":41,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2026,4,8]],"date-time":"2026-04-08T00:00:00Z","timestamp":1775606400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2026,4,8]],"date-time":"2026-04-08T00:00:00Z","timestamp":1775606400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"name":"National Key Research and Development Program of China","award":["No.2023YFB3106600"],"award-info":[{"award-number":["No.2023YFB3106600"]}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["No.62472296"],"award-info":[{"award-number":["No.62472296"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Cybersecurity"],"abstract":"<jats:title>Abstract<\/jats:title>\n                  <jats:p>\n                    The Onion Router (Tor), a cornerstone of online privacy, is increasingly exploited for malicious purposes, creating an urgent need to distinguish its traffic from benign web streams. In response to detection efforts, Tor deploys pluggable transports like Obfs4, which obfuscates traffic using randomized padding and artificial timing delays to evade traditional analysis. Although these transformations obscure surface-level patterns, Obfs4 traffic retains subtle yet exploitable statistical divergences from standard web behavior. Critically, existing detection approaches often fail to achieve the throughput necessary for practical, real-time deployment in high-speed network environments, presenting a significant performance gap. To bridge this performance gap, we introduce\n                    <jats:bold>CTS-OD<\/jats:bold>\n                    : A\n                    <jats:bold>C<\/jats:bold>\n                    ascad-ed\n                    <jats:bold>T<\/jats:bold>\n                    wo-\n                    <jats:bold>S<\/jats:bold>\n                    tage framework for high-throughput\n                    <jats:bold>O<\/jats:bold>\n                    bfs4\n                    <jats:bold>D<\/jats:bold>\n                    etection, engineered for both speed and precision. Our methodology is founded on a compact yet potent set of expressive features selected from early-flow packet data. The first stage implements a label-guided clustering strategy to generate class centroids; these centroids are then indexed using Facebook AI Similarity Search for exceptionally rapid similarity matching, allowing for the immediate classification of the majority of samples. The second stage employs a highly optimized tree-based fallback classifier, which is specifically trained to resolve complex instances that remain ambiguous after the initial assessment. This synergistic architecture achieves an F1-score surpassing 99% and an inference throughput exceeding million samples per second, satisfying the demanding requirements of high-precision, ultra-high-speed inference and making it eminently suitable for real-world deployment.\n                  <\/jats:p>","DOI":"10.1186\/s42400-025-00492-0","type":"journal-article","created":{"date-parts":[[2026,4,8]],"date-time":"2026-04-08T02:01:46Z","timestamp":1775613706000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["CTS-OD: a cascaded two-stage framework for high-throughput Obfs4 detection"],"prefix":"10.1186","volume":"9","author":[{"given":"Yutong","family":"Huang","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Qiang","family":"Zhang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5871-946X","authenticated-orcid":false,"given":"Cheng","family":"Huang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2026,4,8]]},"reference":[{"key":"492_CR1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2023.103512","volume":"135","author":"S Al-E\u2019mari","year":"2023","unstructured":"Al-E\u2019mari S, Sanjalawe Y, Fraihat S (2023) Detection of obfuscated tor traffic based on bidirectional generative adversarial networks and vision transform. Comput Secur 135:103512","journal-title":"Comput Secur"},{"key":"492_CR2","doi-asserted-by":"crossref","unstructured":"Lashkari AH, Gil GD, Mamun MSI, Ghorbani AA (2017) Characterization of tor traffic using time based features. In Proceedings of the 3rd International Conference on Information Systems Security and Privacy - Volume 1: ICISSP,, pp 253\u2013262. INSTICC, SciTePress","DOI":"10.5220\/0006105602530262"},{"issue":"4","key":"492_CR3","first-page":"292","volume":"2019","author":"S Bhat","year":"2019","unstructured":"Bhat S, David L, Kwon A, Devadas S (2019) Var-cnn: a data-efficient website fingerprinting attack based on deep learning. Proc Privacy Enhanc Tech 2019(4):292\u2013310","journal-title":"Proc Privacy Enhanc Tech"},{"key":"492_CR4","doi-asserted-by":"crossref","unstructured":"Sirinam P, Imani M, Juarez M, Wright M (2018) Deep fingerprinting: Undermining website fingerprinting defenses with deep learning. In Proceedings of the 2018 ACM SIGSAC conference on computer and communications security, pp. 1928\u20131943","DOI":"10.1145\/3243734.3243768"},{"key":"492_CR5","doi-asserted-by":"crossref","unstructured":"Lin X, Xiong G, Gou G, Li Z, Shi J, Yu J (2022) Et-bert: a contextualized datagram representation with pre-training transformers for encrypted traffic classification. In Proceedings of the ACM Web Conference 2022, pp. 633\u2013642","DOI":"10.1145\/3485447.3512217"},{"key":"492_CR6","doi-asserted-by":"crossref","unstructured":"Zhang H, Yu L, Xiao X, Li Q, Mercaldo F, Luo X, Liu Q (2023) Tfe-gnn: a temporal fusion encoder using graph neural networks for fine-grained encrypted traffic classification. In Proceedings of the ACM Web Conference 2023, pp. 2066\u20132075","DOI":"10.1145\/3543507.3583227"},{"key":"492_CR7","unstructured":"Tor Project. Tor metrics - anonymity online (2025). https:\/\/metrics.torproject.org\/ Accessed 9 January 2025"},{"issue":"4","key":"492_CR8","first-page":"90","volume":"19","author":"H He","year":"2021","unstructured":"He H, Yang Z, Chen X (2021) Payload encoding representation from transformer for encrypted traffic classification. ZTE Commun 19(4):90\u201397","journal-title":"ZTE Commun"},{"key":"492_CR9","doi-asserted-by":"crossref","unstructured":"Xu W, Zou F (2021) Obfuscated tor traffic identification based on sliding window. Secur Commun Netw","DOI":"10.1155\/2021\/5587837"},{"key":"492_CR10","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2023.103512","volume":"135","author":"S Al-E\u2019mari","year":"2023","unstructured":"Al-E\u2019mari S, Sanjalawe Y, Fraihat S (2023) Detection of obfuscated tor traffic based on bidirectional generative adversarial networks and vision transform. Comput Secur 135:103512","journal-title":"Comput Secur"},{"key":"492_CR11","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2023.110147","volume":"233","author":"J Koumar","year":"2024","unstructured":"Koumar J, Hynek K, Pe\u0161ek J, \u010cejka T (2024) Nettisa: extended ip flow with time-series features for universal bandwidth-constrained high-speed network traffic classification. Comput Netw 233:110147","journal-title":"Comput Netw"},{"key":"492_CR12","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2023.110147","volume":"233","author":"J Koumar","year":"2024","unstructured":"Koumar J, Hynek K, Pe\u0161ek J, \u010cejka T (2024) Nettisa: extended ip flow with time-series features for universal bandwidth-constrained high-speed network traffic classification. Comput Netw 233:110147","journal-title":"Comput Netw"},{"key":"492_CR13","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2021.107974","volume":"190","author":"K Lin","year":"2021","unstructured":"Lin K, Xiaolong X, Gao H (2021) Tscrnn: a novel classification scheme of encrypted traffic based on flow spatiotemporal features for efficient management of iiot. Comput Netw 190:107974","journal-title":"Comput Netw"},{"key":"492_CR14","first-page":"633","volume":"2022","author":"X Lin","year":"2022","unstructured":"Lin X, Xiong G, Gou G, Li Z, Shi J, Jing Yu (2022) Et-bert: a contextualized datagram representation with pre-training transformers for encrypted traffic classification. Proc ACM Web Conf 2022:633\u2013642","journal-title":"Proc ACM Web Conf"},{"key":"492_CR15","doi-asserted-by":"crossref","unstructured":"Panchenko A, Lanze F, Pennekamp J, Engel T, Zinnen A, Henze M, Wehrle K (2016) Website fingerprinting at internet scale. In 23rd Annual Network and Distributed System Security Symposium (NDSS)","DOI":"10.14722\/ndss.2016.23477"},{"key":"492_CR16","doi-asserted-by":"crossref","unstructured":"van Ede T, Peter A, Pras A (2020) Flowprint: Semi-supervised mobile-app fingerprinting on encrypted network traffic. arXiv preprint arXiv:2002.03609","DOI":"10.14722\/ndss.2020.24412"},{"key":"492_CR17","unstructured":"Ju\u00e1rez M, Imani M, Perry M, D\u0131az C, Wright M (2015) Wtf-pad: toward an efficient website fingerprinting defense for tor. CoRR, abs\/1512.00524"},{"key":"492_CR18","doi-asserted-by":"crossref","unstructured":"Fauvel K, Chen F, Rossi D (2023) A lightweight, efficient and explainable-by-design convolutional neural network for internet traffic classification. In Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pp. 1\u20139. ACM","DOI":"10.1145\/3580305.3599762"},{"key":"492_CR19","first-page":"5","volume":"3","author":"MS Rahman","year":"2020","unstructured":"Rahman MS, Sirinam P, Mathews N, Gangadhara KG (2020) Wright M (2020) Tik-tok: the utility of packet timing in website fingerprinting attacks. Proc Privacy Enhanc Tech 3:5\u201324","journal-title":"Proc Privacy Enhanc Tech"},{"key":"492_CR20","doi-asserted-by":"crossref","unstructured":"Wang W, Zhu M, Zeng X, Ye X, Sheng Y (2017) Malware traffic classification using convolutional neural network for representation learning. In 2017 International Conference on Information Networking (ICOIN), pp 712\u2013717. IEEE","DOI":"10.1109\/ICOIN.2017.7899588"},{"key":"492_CR21","doi-asserted-by":"crossref","unstructured":"Liu C, He L, Xiong G, Cao Z, Li Z (2019) Fs-net: A flow sequence network for encrypted traffic classification. In IEEE Conference on Computer Communications (INFOCOM), pp 1171\u20131179","DOI":"10.1109\/INFOCOM.2019.8737507"},{"key":"492_CR22","doi-asserted-by":"publisher","first-page":"3344","DOI":"10.1109\/TIFS.2021.3050608","volume":"16","author":"M Shen","year":"2021","unstructured":"Shen M, Fan Y, Cheng Y, Li Y, Liu Y, Zhu H, Ren K (2021) Accurate decentralized application identification via encrypted traffic analysis using graph neural networks. IEEE Trans Inf Forensics Secur 16:3344\u20133359","journal-title":"IEEE Trans Inf Forensics Secur"},{"key":"492_CR23","doi-asserted-by":"publisher","first-page":"3344","DOI":"10.1109\/TIFS.2021.3050608","volume":"16","author":"M Shen","year":"2021","unstructured":"Shen M, Fan Y, Cheng Y, Li Y, Liu Y, Zhu H, Ren K (2021) Accurate decentralized application identification via encrypted traffic analysis using graph neural networks. IEEE Trans Inf Forensics Secur 16:3344\u20133359","journal-title":"IEEE Trans Inf Forensics Secur"},{"key":"492_CR24","doi-asserted-by":"crossref","unstructured":"Zheng W, Gou C, Yan L, Mo S (2020) Learning to classify: A flow-based relation network for encrypted traffic classification. In Proceedings of The Web Conference 2020, pp. 13\u201322","DOI":"10.1145\/3366423.3380090"},{"key":"492_CR25","doi-asserted-by":"crossref","unstructured":"Zhang H, Gou G, Xiong G, Liu C, Tan Y, Ye K (2021) Multi-granularity mobile encrypted traffic classification based on fusion features. In International Conference on Machine Learning and Intelligent Communications, pp. 1\u201312. Springer","DOI":"10.1007\/978-3-030-89137-4_11"},{"key":"492_CR26","doi-asserted-by":"crossref","unstructured":"Sirinam P, Mathews N, Rahman MS, Wright M (2019) Triplet fingerprinting: More practical and portable website fingerprinting with n-shot learning. In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, pp. 1131\u20131148. ACM","DOI":"10.1145\/3319535.3354217"},{"key":"492_CR27","doi-asserted-by":"crossref","unstructured":"Li W, Quenard G (2021) Towards a multi-label dataset of internet traffic for digital behavior classification. In 2021 3rd International Conference on Computer Communication and the Internet (ICCCI), pp. 38\u201346. IEEE","DOI":"10.1109\/ICCCI51764.2021.9486831"},{"key":"492_CR28","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2021.108267","volume":"196","author":"G Xie","year":"2021","unstructured":"Xie G, Li Q, Jiang Y (2021) Self-attentive deep learning method for online traffic classification and its interpretability. Comput Netw 196:108267","journal-title":"Comput Netw"},{"key":"492_CR29","unstructured":"Shen M, Ji K, Gao Z, Li Q, Zhu L, Xu K (2023) Subverting website fingerprinting defenses with robust traffic representation. In 32nd USENIX Security Symposium (USENIX Security 23), pp. 607\u2013624"},{"key":"492_CR30","doi-asserted-by":"crossref","DOI":"10.1016\/j.comnet.2023.109796","volume":"229","author":"K Wang","year":"2023","unstructured":"Wang K, Gao J, Lei X (2023) Mtc: a multi-task model for encrypted network traffic classification based on transformer and 1d-cnn. Comput Netw 229:109799","journal-title":"Comput Netw"},{"key":"492_CR31","doi-asserted-by":"crossref","DOI":"10.1016\/j.comnet.2023.109796","volume":"229","author":"K Wang","year":"2023","unstructured":"Wang K, Gao J, Lei X (2023) Mtc: a multi-task model for encrypted network traffic classification based on transformer and 1d-cnn. Comput Netw 229:109799","journal-title":"Comput Netw"},{"key":"492_CR32","doi-asserted-by":"crossref","unstructured":"Wang T, Xie X, Wang W, Wang C, Zhao Y, Cui Y (2024) Netmamba: Efficient network traffic classification via pre-training unidirectional mamba. arXiv preprint arXiv:2405.11449","DOI":"10.1109\/ICNP61940.2024.10858569"},{"key":"492_CR33","unstructured":"Wang T, Cai X, Nithyanand R, Johnson R, Goldberg I (2014) Effective attacks and provable defenses for website fingerprinting. In 23rd USENIX Security Symposium (USENIX Security 14), pp. 143\u2013157"},{"key":"492_CR34","doi-asserted-by":"crossref","unstructured":"Rimmer V, Preuveneers D, Juarez M, Goethem TV, Joosen W (2018) Automated website fingerprinting through deep learning. In Proceedings 2018 Network and Distributed System Security Symposium, NDSS 2018. Internet Society","DOI":"10.14722\/ndss.2018.23105"},{"issue":"3","key":"492_CR35","doi-asserted-by":"publisher","first-page":"5","DOI":"10.2478\/popets-2020-0043","volume":"2020","author":"MS Rahman","year":"2020","unstructured":"Rahman MS, Sirinam P, Mathews N, Gangadhara KG, Wright M (2020) Tik-tok: the utility of packet timing in website fingerprinting attacks. Proceed Privacy Enhanc Technol 2020(3):5\u201324","journal-title":"Proceed Privacy Enhanc Technol"},{"key":"492_CR36","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2021.108267","volume":"196","author":"G Xie","year":"2021","unstructured":"Xie G, Li Q, Jiang Y (2021) Self-attentive deep learning method for online traffic classification and its interpretability. Comput Netw 196:108267","journal-title":"Comput Netw"},{"key":"492_CR37","doi-asserted-by":"publisher","first-page":"5587837","DOI":"10.1155\/2021\/5587837","volume":"2021","author":"W Xu","year":"2021","unstructured":"Xu W, Zou F (2021) Obfuscated tor traffic identification based on sliding window. Secur Commun Netw 2021:5587837","journal-title":"Secur Commun Netw"},{"key":"492_CR38","unstructured":"Selenium Contributors. Selenium: A browser automation framework, 2025. https:\/\/github.com\/SeleniumHQ\/selenium Accessed 25 April 2025"},{"key":"492_CR39","first-page":"2066","volume":"2023","author":"H Zhang","year":"2023","unstructured":"Zhang H, Le Yu, Xiao X, Li Q, Mercaldo F, Luo X, Liu Q (2023) Tfe-gnn: a temporal fusion encoder using graph neural networks for fine-grained encrypted traffic classification. Proc ACM Web Conf 2023:2066\u20132075","journal-title":"Proc ACM Web Conf"},{"key":"492_CR40","unstructured":"The Tcpdump Group. tcpdump: A powerful command-line packet analyzer. https:\/\/www.tcpdump.org\/, 2025. Accessed: 2025-06-04"},{"key":"492_CR41","first-page":"13","volume":"2020","author":"W Zheng","year":"2020","unstructured":"Zheng W, Gou C, Yan L, Mo S (2020) Learning to classify: a flow-based relation network for encrypted traffic classification. Proc Web Conf 2020:13\u201322","journal-title":"Proc Web Conf"}],"container-title":["Cybersecurity"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s42400-025-00492-0.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1186\/s42400-025-00492-0","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s42400-025-00492-0.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,4,8]],"date-time":"2026-04-08T02:01:55Z","timestamp":1775613715000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1186\/s42400-025-00492-0"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,4,8]]},"references-count":41,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2026,12]]}},"alternative-id":["492"],"URL":"https:\/\/doi.org\/10.1186\/s42400-025-00492-0","relation":{},"ISSN":["2523-3246"],"issn-type":[{"value":"2523-3246","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,4,8]]},"assertion":[{"value":"19 June 2025","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"19 September 2025","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"8 April 2026","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare that they have no Conflict of interest as defined by Springer, or other interests that might be perceived to influence the results and\/or discussion reported in this paper.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Competing interests"}}],"article-number":"53"}}