Correlation Attack
A correlation attack tries to link the inbound and outbound traffic of an anonymity network — by timing, volume, or other patterns. It requires a global or very powerful observer.
How correlation works
An observer who sees both the guard and the exit (or large parts of the network) can try to match connections that happen at the same time. Tor uses padding and multiplexing to make this harder — but it is not perfect protection against a global adversary.
Practical relevance
For ordinary users this risk is low. In high-risk contexts (state surveillance, investigative work) it belongs in the threat model.
Category: Security
This page is a short glossary definition, not a full encyclopedia article. See the Tor glossary A–Z for the rest of the set.