If an attacker can observe the Tor user, and the website being visited, it is possible to correlate the traffic by looking at time and size distributions of the communication.
Techniques such as random time delays, padding, fake cover traffic, and changing packet ordering may make this correlation harder.
Does Tor perform any of these techniques? Are there analyses if such techniques would considerably help in maintaining anonymity?