Packet Size Pluggable Transport and Traffic Morphing

It is well known [1] that Tor traffic can be distinguished from other network protocols by its distinctive packet size. Due to the sized Tor cells, most TCP packets of Tor traffic are 586 bytes in size (See Figure 1). On the other hand, HTTPS, the protocol that Tor tries to simulate,1 has a much more spread out packet size probability distribution (See Figure 2) This means that an adversary can detect Tor traffic by using packets of size 586 as distinguishers [2] [1].