ARCHIVES

The geographic distribution of Tor nodes, particularly Exit nodes, plays an important role in cybersecurity research because attackers frequently exploit the Tor network to conceal their identities, evade tracking, and obscure the origin of malicious traffic. Unfortunately, the previous efforts mainly focuses on the frequency of IP address of Tor nodes, which makes it difficult to conduct detecing structural change-points detection.This study investigates metric comparison for the distributional change-point detection in Tor Exit node data collected daily from October 24, 2025 to March 12, 2026. IP addresses were converted into geographic coordinates using the GeoLite2-City database, and temporal changes in the spatial distribution were analyzed using six distance measures: Wasserstein (Earth Mover’s) distance, Sinkhorn distance, Energy distance, Jensen–Shannon distance, Hellinger distance, and Total Variation distance. It was found that using the geometry-based Wasserstein distance yielded clear results in the detection of day-to-day changes. Specifically, significant points of change were detected in early December and mid-February. On the other hand, it was found that density-based distances, such as the JS and Hellinger distances, were effective for detecting changes in trends, such as drift shifts. The timing of the drift shifts largely coincided with the timing detected by the day-to-day change detection method. Conversely, it became apparent that the use of geometry-based methods resulted in the false detection of drift shifts around January.