CTS-OD: a cascaded two-stage framework for high-throughput Obfs4 detection

Abstract The Onion Router (Tor), a cornerstone of online privacy, is increasingly exploited for malicious purposes, creating an urgent need to distinguish its traffic from benign web streams. In response to detection efforts, Tor deploys pluggable transports like Obfs4, which obfuscates traffic using randomized padding and artificial timing delays to evade traditional analysis. Although these transformations obscure surface-level patterns, Obfs4 traffic retains subtle yet exploitable statistical divergences from standard web behavior. Critically, existing detection approaches often fail to achieve the throughput necessary for practical, real-time deployment in high-speed network environments, presenting a significant performance gap. To bridge this performance gap, we introduce CTS-OD : A C ascad-ed T wo- S tage framework for high-throughput O bfs4 D etection, engineered for both speed and precision. Our met