Editing Traffic analysis (section)

== Breaking the anonymity of networks ==
Traffic analysis method can be used to break the [[anonymity]] of anonymous networks, e.g., [[Tor (anonymity network)|TORs]].<ref name=":0" /> There are two methods of traffic-analysis attack, passive and active. 

*In passive traffic-analysis method, the attacker extracts features from the traffic of a specific flow on one side of the network and looks for those features on the other side of the network. 
*In active traffic-analysis method, the attacker alters the timings of the packets of a flow according to a specific pattern and looks for that pattern on the other side of the network; therefore, the attacker can link the flows in one side to the other side of the network and break the anonymity of it. It is shown, although timing noise is added to the packets, there are active traffic analysis methods robust against such a noise.{{Failed verification | date = August 2022 | reason = The reference doesn't generally talk about active and passive analysis.  It suggests 2 active analyses that match this description, but didn't say this is the only way active analysis can be done like this sentence does.  It's questionable that this description is comprehensively right; see relay early traffic confirmation which is an active analysis.}}<ref name=":0" />