Detection of Virtual Private Network Traffic Using Machine Learning

Miller, Shane; Curran, Kevin; Lunney, Tom

doi:10.4018/ijwnbt.2020070104

Cited by 14 publications

(11 citation statements)

References 35 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…3, where 55.3% of the data instances were classified as non-VPN and the remaining, i.e., 44.7%, were classified as VPN when the time interval 60 s. In addition, Fig. 3 also shows the distribution of the dataset in each class over different time intervals (15,30,120). Other exploration tasks were also conducted to better understand the dataset; those included understanding the outliers as shown in Fig.…”

Section: Exploratory Data Analysismentioning

confidence: 99%

See 1 more Smart Citation

VPN and Non-VPN Network Traffic Classification Using Time-Related Features

Al-Fayoumi¹,

Al-Fawa’reh²,

Nashwan³

2022

Computers, Materials &Amp; Continua

View full text Add to dashboard Cite

The continual growth of the use of technological appliances during the COVID-19 pandemic has resulted in a massive volume of data flow on the Internet, as many employees have transitioned to working from home. Furthermore, with the increase in the adoption of encrypted data transmission by many people who tend to use a Virtual Private Network (VPN) or Tor Browser (dark web) to keep their data privacy and hidden, network traffic encryption is rapidly becoming a universal approach. This affects and complicates the quality of service (QoS), traffic monitoring, and network security provided by Internet Service Providers (ISPs), particularly for analysis and anomaly detection approaches based on the network traffic's nature. The method of categorizing encrypted traffic is one of the most challenging issues introduced by a VPN as a way to bypass censorship as well as gain access to geo-locked services. Therefore, an efficient approach is especially needed that enables the identification of encrypted network traffic data to extract and select valuable features which improve the quality of service and network management as well as to oversee the overall performance. In this paper, the classification of network traffic data in terms of VPN and non-VPN traffic is studied based on the efficiency of time-based features extracted from network packets. Therefore, this paper suggests two machine learning models that categorize network traffic into encrypted and non-encrypted traffic. The proposed models utilize statistical features (SF), Pearson Correlation (PC), and a Genetic Algorithm (GA), preprocessing the traffic samples into net flow traffic to accomplish the experiment's objectives. The GA-based method utilizes a stochastic method based on natural genetics and biological evolution to extract essential features. The PC-based method performs well in removing different features of network traffic. With a microsecond perpacket prediction time, the best model achieved an accuracy of more than 95.02 percent in the most demanding traffic classification task, a drop in accuracy of only 2.37 percent in comparison to the entire statistical-based machine learning approach. This is extremely promising for the development of real-time traffic analyzers.

show abstract

Section: Exploratory Data Analysismentioning

confidence: 99%

“…In 2020, Miller et al [30] presented a computational approach to detect VPN traffic, where the flow statistics data found in captured network packets' TCP headers were extracted. A multi-layered perceptron neural network with 10-fold cross-validation was used.…”

Section: Introductionmentioning

confidence: 99%

VPN and Non-VPN Network Traffic Classification Using Time-Related Features

Al-Fayoumi¹,

Al-Fawa’reh²,

Nashwan³

2022

Computers, Materials &Amp; Continua

View full text Add to dashboard Cite

show abstract

“…Another field that was also covered by researchers was the detection of malicious virtual private network (VPN) traffic. Miller et al [95] proposed a computational model to address the current limitations in detecting VPN traffic and aid in the detection of VPN technologies that are being used to hide an attacker's identity. A model was built to detect VPN usage by using a MLP trained neural network by flow statistics found in the captured network packets' TCP header.…”

Section: Malicious Traffic Classificationmentioning

confidence: 99%

Intelligent Techniques for Detecting Network Attacks: Review and Research Directions

Aljabri

Aljameel

Mohammad

et al. 2021

Sensors

View full text Add to dashboard Cite

The significant growth in the use of the Internet and the rapid development of network technologies are associated with an increased risk of network attacks. Network attacks refer to all types of unauthorized access to a network including any attempts to damage and disrupt the network, often leading to serious consequences. Network attack detection is an active area of research in the community of cybersecurity. In the literature, there are various descriptions of network attack detection systems involving various intelligent-based techniques including machine learning (ML) and deep learning (DL) models. However, although such techniques have proved useful within specific domains, no technique has proved useful in mitigating all kinds of network attacks. This is because some intelligent-based approaches lack essential capabilities that render them reliable systems that are able to confront different types of network attacks. This was the main motivation behind this research, which evaluates contemporary intelligent-based research directions to address the gap that still exists in the field. The main components of any intelligent-based system are the training datasets, the algorithms, and the evaluation metrics; these were the main benchmark criteria used to assess the intelligent-based systems included in this research article. This research provides a rich source of references for scholars seeking to determine their scope of research in this field. Furthermore, although the paper does present a set of suggestions about future inductive directions, it leaves the reader free to derive additional insights about how to develop intelligent-based systems to counter current and future network attacks.

show abstract

“…VPNs mask your IP address by allowing the network to forward it through a specially configured and remotely configured server under the management of the VPN host. This is means that if user browse the Internet by VPN, a server of VPN becomes user data source [4]. This is means that user internet service providers (ISPs) with others 3 rd parties can't know what a websites user visits or what a data user send or as well as receive over the internet.…”

Section: Introductionmentioning

confidence: 99%

Proposing a security system for the VPN through design and implementation of a scheme for android and IOS mobiles based on two-factor authentication

Lehmoud¹,

Obeis²,

Mutar³

2022

PEN

View full text Add to dashboard Cite

A virtual private network (VPN) is a network, but a virtual network means that it creates a virtual bridge between the user and the server located somewhere across the world, and this network is private because to connect the connection with it you must have an account and password. The idea of VPN arose to protect its communications from industrial espionage, because there are very easy ways to penetrate a network and steal the information circulating in it. Data transmission encryption protocols and tunneling systems are used in order to secure the transfer of information between two points back and forth, so their data is encrypted and protected. Hacking the VPN is a very dangerous thing because of the importance and privacy of the data. Therefore, special systems must be provided for the VPN to suit the network's work scenarios with high security. In our work, we proposed a private authentication system for the VPN network that provides high security with fast execution and reliability based on two factors authentications: Using the varieties of authentications method, robust VPNs screen everybody who will tries to sign in. An authentication system was designed based on a special user interface that provides an easy environment for choosing two passwords in two different stages of registration and authentication. The proposed system was implemented on Android and iOS devices. The proposed system was evaluated through experiments with 720 participants with 3600 system entry processes, then the proposed system was tested in terms of its ability to break and resistance to different types of attacks. Where it was tested by 1900 attacks at different times with participants who were randomly selected from the main sample of participants during the implementation period of 30 days through using the modern types of mobile devices.

show abstract

Detection of Virtual Private Network Traffic Using Machine Learning

Cited by 14 publications

References 35 publications

VPN and Non-VPN Network Traffic Classification Using Time-Related Features

VPN and Non-VPN Network Traffic Classification Using Time-Related Features

Intelligent Techniques for Detecting Network Attacks: Review and Research Directions

Proposing a security system for the VPN through design and implementation of a scheme for android and IOS mobiles based on two-factor authentication

Contact Info

Product

Resources

About