Skip down to main content
The Global Information and
Technology
Controls Hub

Identifying Anomalies in Tor Usage

tor_tracker_example
tor_tracker_example
Published: 14 November 2022

Introduction

The “GLITCH Tor Tracker” detects ongoing per-country anomalies in the daily usage metrics of the Tor anonymous communication network.

The tracker’s approach identifies contiguous anomalous periods, rather than daily spikes or drops, and allows anomalies to be ranked according to deviation from expected behaviour. The detection tool has been in developemnet since August 2016, and is in use by a number of individuals, academics, and NGOs as an early warning system for potential censorship events. While this tracker focusses on Tor, it’s approach is more generally applicable to usage data of other services, both individually and in combination. Future iterations of our tracker will look to combine multiple data sources which will allow more specific identification of likely Tor blocking events.

Data

The data used for the GLITCH Tor Tracker comes for Tor Metrics.

Methodology & Academic Foundations

The “ISIC Tor Tracker” is based on the paper “On Identifying Anomalies in Tor Usage with Applications in Detecting Internet Censorship”[1]

Footnotes

1. Joss Wright, Alexander Darer, and Oliver Farnan. 2018. On Identifying Anomalies in Tor Usage with Applications in Detecting Internet Censorship. In Proceedings of the 10th ACM Conference on Web Science (WebSci ’18). Association for Computing Machinery, New York, NY, USA, 87–96. https://doi.org/10.1145/3201064.3201093