Improving Tor Hidden Service Classification with a Hybrid LSTM and BiGRU Deep Learning Model

Abstract

The Tor network provides strong anonymity through onion routing, but its hidden services are often exploited for illegal activities, posing significant challenges to network security and monitoring. Traditional website fingerprinting methods rely mainly on packet-level features, which fail to capture semantic and contextual information, resulting in limited accuracy. To address this issue, this paper proposes a novel fingerprinting framework that integrates BERT for extracting rich semantic features from Tor webpage content and LSTM for modeling temporal patterns across multiple pages. Furthermore, an enhanced architecture incorporating a BiGRU layer is introduced to enable bidirectional feature learning and improve classification robustness. The proposed system effectively analyzes both textual and sequential characteristics of Tor services, leading to more accurate identification of normal and malicious activities. Experimental results demonstrate that the model achieves an accuracy of 97.86%, outperforming conventional CNN-based deep fingerprinting methods in terms of precision, recall, and F1-score, thereby providing a reliable and scalable solution for secure Tor traffic analysis.