A Novel Lightweight Anonymous Proxy Traffic Detection Method Based on Spatio-Temporal Features

Abstract

Anonymous proxies are used by criminals for illegal network activities due to their anonymity, such as data theft and cyber attacks. Therefore, anonymous proxy traffic detection is very essential for network security. In recent years, detection based on deep learning has become a hot research topic, since deep learning can automatically extract and select traffic features. To make (heterogeneous) network traffic adapt to the homogeneous input of typical deep learning algorithms, a major branch of existing studies convert network traffic into images for detection. However, such studies are commonly subject to the limitation of large-sized image representation of network traffic, resulting in very large storage and computational resource overhead. To address this limitation, a novel method for anonymous proxy traffic detection is proposed. The method is one of the solutions to reduce storage and computational resource overhead. Specifically, it converts the sequences of the size and inter-arrival time of the first N packets of a flow into images, and then categorizes the converted images using the one-dimensional convolutional neural network. Both proprietary and public datasets are used to validate the proposed method. The experimental results show that the converted images of the method are at least 90% smaller than that of existing image-based deep learning methods. With substantially smaller image sizes, the method can still achieve F1 scores up to 98.51% in Shadowsocks traffic detection and 99.8% in VPN traffic detection.

AE-DTI: An Efficient Darknet Traffic Identification Method Based on Autoencoder Improvement

“…This method can analyze the information carried in the header of the data packet and realize the accurate classification of the dark network traffic, which effectively improves the performance of the classification process. He et al [19] proposed a method for analyzing anonymous proxy traffic by converting the size sequence and inter-arrival time sequence of the initial N data packets of the flow into images. These images were then classified using a one-dimensional convolutional neural network.…”

Tabular-to-Image Transformations for the Classification of Anonymous Network Traffic Using Deep Residual Networks

“…He et al [14] developed a one-dimensional CNN model to classify anonymous proxy traffic with smaller image sizes. First, they converted two-way and one-way Spatiotemporal features to one-dimensional images.…”

“…Convolutional neural networks (CNNs) are one such model that can exploit properties such as locality and order between components of the data [12]. Prior research [9], [13], [14] has proven the effectiveness of CNNs in classifying network traffic when trained on T2I data. Other CNN variants, such as deep residual networks (ResNet), have also yielded high performance in a broad range of classification tasks.…”

A network traffic identification method based on AutoEncoder - a feature selection algorithm

“…Liang et al [5] extracted Tor traffic feature matches for feature enhancement by building a logistic regression-based deep neural network, and used an artificial bee colony mechanism instead of common iterative algorithms such as gradient descent to achieve real-time traffic identification. Yanjie.He et al [6] converted the size sequence and arrival interval time sequence of the first N packets of a stream by analyzing anonymous proxy traffic. Xin Tong et al [7] proposed a traffic analysis method "Dark-Forest", which uses a particle swarm optimization algorithm to Liu, Z et al [8] proposed a method called ELD (Extending Labeled Data) to identify the labels of new unknown mobile traffic and thus extend the labeled mobile traffic data.…”