Abstract: With the development and application of machine learning and deep learning,attackers can conduct traffic analysis on malicious nodes and malicious AS on Tor user links,thus carrying out de-anonymization attacks on Tor users.At present,one of the common defense methods for traffic analysis attacks is to insert virtual packets or delay real packets to change traffic characteristics,which will introduce bandwidth and delay costs.The other type defends by dividing user traffic and transmitting it through multiple paths.This method lacks the perception of malicious nodes and malicious AS on the circuit.When an attacker collects a complete traffic trail,it is still difficult to resist the de-anonymization attack on Tor users by traffic analysis.In order to make up for the lack of threat awareness in the path selection of multi-path defense methods,this paper proposes a multipath selection algorithm based on threat awareness,which integrates malicious node awareness and malicious AS awareness.Firstly,an improved method of node distance measurement is proposed,and the improved distance measurement is used to cluster nodes based on K-Mediods algorithm,which improves the detection effect of malicious nodes.Then the improved AS sensing algorithm is improved the anonymity requirement.Finally,a multi-path selection algorithm based on threat perception is proposed by combining malicious node detection and AS sensing algorithm.The experimental results show that the proposed algorithm can not only resist a variety of traffic analysis attacks,but also ensure certain performance requirements of Tor circuits.

Key words: Anonymous communication, Traffic analysis, Multipath, Malicious node detection, AS awareness