# DeepCorr: Strong Flow Correlation Attacks on Tor Using Deep Learning

arXiv: https://arxiv.org/abs/1808.07285 · HTML: https://mlsanity.com/paper/1808.07285/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 22 Aug 2018.

## Built on by (most cited first, 8 of 8)

- [Remote Timing Attacks on Efficient Language Model Inference](https://mlsanity.com/paper/2410.17175/) (2024)
- [Jekyll: Attacking Medical Image Diagnostics using Deep Generative Models](https://mlsanity.com/paper/2104.02107/) (2021)
- [SiamHAN: IPv6 Address Correlation Attacks on TLS Encrypted Traffic via Siamese Heterogeneous Graph Attention Network](https://mlsanity.com/paper/2204.09465/) (2022)
- [UniNet: A Unified Multi-granular Traffic Modeling Framework for Network Security](https://mlsanity.com/paper/2503.04174/) (2025)
- [From Privacy to Workflow Integrity: Communication-Graph Metadata in Autonomous Agent Interoperability](https://mlsanity.com/paper/2606.07150/) (2026)
- [Breaking On-Chip Communication Anonymity using Flow Correlation Attacks](https://mlsanity.com/paper/2309.15687/) (2023)
- [RECTor: Robust and Efficient Correlation Attack on Tor](https://mlsanity.com/paper/2512.00436/) (2025)
- [Tracing the Chain: Deep Learning for Stepping-Stone Intrusion Detection](https://mlsanity.com/paper/2604.08800/) (2026)

## Abstract (arXiv)

Flow correlation is the core technique used in a multitude of deanonymization attacks on Tor. Despite the importance of flow correlation attacks on Tor, existing flow correlation techniques are considered to be ineffective and unreliable in linking Tor flows when applied at a large scale, i.e., they impose high rates of false positive error rates or require impractically long flow observations to be able to make reliable correlations. In this paper, we show that, unfortunately, flow correlation attacks can be conducted on Tor traffic with drastically higher accuracies than before by leveraging emerging learning mechanisms. We particularly design a system, called DeepCorr, that outperforms the state-of-the-art by significant margins in correlating Tor connections. DeepCorr leverages an advanced deep learning architecture to learn a flow correlation function tailored to Tor's complex network this is in contrast to previous works' use of generic statistical correlation metrics to correlated Tor flows. We show that with moderate learning, DeepCorr can correlate Tor connections (and therefore break its anonymity) with accuracies significantly higher than existing algorithms, and using substantially shorter lengths of flow observations. For instance, by collecting only about 900 packets of each target Tor flow (roughly 900KB of Tor data), DeepCorr provides a flow correlation accuracy of 96% compared to 4% by the state-of-the-art system of RAPTOR using the same exact setting. We hope that our work demonstrates the escalating threat of flow correlation attacks on Tor given recent advances in learning algorithms, calling for the timely deployment of effective countermeasures by the Tor community.