CTS-OD: a cascaded two-stage framework for high-throughput Obfs4 detection

Abstract The Onion Router (Tor), a cornerstone of online privacy, is increasingly exploited for malicious purposes, creating an urgent need to distinguish its traffic from benign web streams. In response to detection efforts, Tor deploys pluggable transports like Obfs4, which obfuscates traffic using randomized padding and artificial timing delays to evade traditional analysis. Although these transformations obscure surface-level patterns, Obfs4 traffic retains subtle yet exploitable statistical divergences from standard web behavior. Critically, existing detection approaches often fail to achieve the throughput necessary for practical, real-time deployment in high-speed network environments, presenting a significant performance gap. To bridge this performance gap, we introduce CTS-OD : A C ascad-ed T wo- S tage framework for high-throughput O bfs4 D etection, engineered for both speed and precision. Our methodology is founded on a compact yet potent set of expressive features selected from early-flow packet data. The first stage implements a label-guided clustering strategy to generate class centroids; these centroids are then indexed using Facebook AI Similarity Search for exceptionally rapid similarity matching, allowing for the immediate classification of the majority of samples. The second stage employs a highly optimized tree-based fallback classifier, which is specifically trained to resolve complex instances that remain ambiguous after the initial assessment. This synergistic architecture achieves an F1-score surpassing 99% and an inference throughput exceeding million samples per second, satisfying the demanding requirements of high-precision, ultra-high-speed inference and making it eminently suitable for real-world deployment.