After I read this link, I tried to understand how they manage detect TOR traffic
The most understandable source for me was this paper
He is saying TOR trafic can be detected by port, cipher suite length , extensions and validity duration of certificate can be use. I tried to implement that and I saw TOR corrected all their weaknesses which are pointed in the document.
According to my experiences it is not possible to detect TOR users in network, but how are companies able to detect TOR? I am extremely curious. Does TOR have any TLS abnormalities?