HYDRA: Hybrid CNN-Transformer Approach for Advanced Flow Correlation in Tor

Flow correlation attacks occur when adversaries link clients to their destinations by analyzing network traffic flows from the same circuit. These attacks remain a critical challenge in anonymous communication networks like Tor. This work presents HYDRA, a Transformer-based multimodal framework for robust Tor traffic analysis. HYDRA introduces a feature reconstruction network that intelligently compensates for missing modality data, enabling accurate predictions even in highly incomplete input scenarios. The architecture fuses statistical, frequency-domain, and flow-level features through a hybrid CNN-Transformer design, capturing fine-grained and long-range patterns in encrypted traffic. Experimental results demonstrate HYDRA's superior generalization, achieving 98.46% training and 97.42% testing accuracy by epoch 50 while maintaining low false positive rates (False Positive Rate below 1% after epoch 20). Compared to ESPRESSO and DeepCoFFEA, HYDRA reduces training time per epoch by 25% and GPU memory usage by 24% approximately, establishing it as fast and resource-efficient. HYDRA retains high reliability under dynamic and noisy network conditions, making it ideal for real-world deployment in privacy-preserving environments.