VoIP Traffic Detection in Tunneled and Anonymous Networks Using Deep Learning

Abstract

Network management is facing a great challenge to analyze and identify encrypted network traffic with specific applications and protocols. A significant number of network users applying different encryption techniques to network applications and services to hide the true nature of the network communication. These challenges attract the network community to improve network security and enhance network service quality. Network managers need novel techniques to cope with the failure and shortcomings of the port-based and payload-based classification methods of encrypted network traffic due to emergent security technologies. Mainly, the famous network hopping mechanisms used to make network traffic unknown and anonymous are VPN (virtual private network) and TOR (Onion Router). This paper presents a novel scheme to unveil encrypted network traffic and easily identify the tunneled and anonymous network traffic. The proposed identification scheme uses the highly desirable deep learning techniques to easily and efficiently identify the anonymous network traffic and extract the Voice over IP (VoIP) and Non VoIP ones within encrypted traffic flows. Finally, the captured traffic has been classified into four different categories, i-e., VPN VoIP, VPN Non-VoIP, TOR VoIP, and TOR Non-VoIP. The experimental results show that our identification engine is extremely robust to VPN and TOR network traffic.

Dark-Forest: Analysis on the Behavior of Dark Web Traffic via DeepForest and PSO Algorithm

“…The accuracy rate reached 98% in the test on the ISCX-VPN-2016 [19] dataset. To analyze VoIP traffic in tunneled and anonymous networks, the captured raw traffic is preprocessed based on the feature engineering of FSTFs [20], and then a hybrid deep learning model (MLP, 1D-CNN, and LSTM) is used for classification, which can classify traffic data into four categories: VPN VoIP, VPN Non-VoIP, TOR VoIP, and TOR Non-VoIP, and the classification accuracy can exceed 94%. In addition, experiments in work [21] show that the attention mechanism [22] can help the deep learning model focus on the more critical information in encrypted traffic and ignore the noise that is meaningless to the detection task, which can further improve the detection effect of the model.…”

A deep learning‐based framework to identify and characterise heterogeneous secure network traffic

“…Port‐based and deep packet inspection‐based techniques were employed to classify the network traffic in the past. However, these methods are invalidated due to the emergence of obfuscation techniques such as the usage of random ports and payload encryption [13]. Therefore, researchers introduced statistical‐based classification techniques to fulfil the requirement of network security for intelligent identification of different network applications and protocols.…”

“…The widely used, traditional inspection methods are mainly categorised into two sections; such as deep packet-based [4][5][6][7] and port-based [8,9]. These early detection procedures failed to recognise the network traffic accurately due to the implementation of the encryption protocols, such as Secure Sockets layer (SSL) and Transport Security Layer (TLS) and the usage of non-standard ports [10][11][12][13]. Machine learning techniques overcome the failure of payload-based classification and port-based classification techniques.…”

Integrating Blockchain and Deep Learning for Enhanced Mobile VPN Forensics: A Comprehensive Framework

“…These countries have enforced laws making VPN use on phones illegal, accompanied by severe fines and potential imprisonment. Such measures underscore the increasing focus on VPN usage globally, particularly when they are employed to circumvent geo-restrictions and access blocked content, raising significant issues regarding cybersecurity and national security [1][2][3].…”