The invention discloses a method used for tracing hidden service in a Tor anonymous network. A side channel is used to identify a Guard node of Tor hidden service, and the found Guard node and a flowwatermarking technology are used to detect the host IP address set of the suspected Tor hidden service, and finally, an intersection is used to determine the IP address of the hidden service. The technical scheme provided by the invention has higher accuracy, and the position information (IP address) of the Tor anonymous network hidden service can be effectively cracked, and therefore great technical support is provided for joint fight of international and national law enforcement agencies against network crimes, and good feasibility and good practicability are provided.