A Comprehensive Review of Tunnel Detection on Multilayer Protocols: From Traditional to Machine Learning Approaches

Tunnels, a key technology of traffic obfuscation, are increasingly being used to evade censorship. While providing convenience to users, tunnel technology poses a hidden danger to cybersecurity due to its concealment and camouflage capabilities. In contrast to previous studies of encrypted traffic d...

Full description

Saved in:
Bibliographic Details
Published inApplied sciences Vol. 13; no. 3; p. 1974
Main Authors Sui, Zhonghang, Shu, Hui, Kang, Fei, Huang, Yuyao, Huo, Guoyu
Format Journal Article
LanguageEnglish
Published Basel MDPI AG 01.02.2023
Subjects
Camouflage
Classification
Communication
cyber security
Data compression
Keywords
Learning algorithms
Machine learning
multilayer protocols
Multilayers
network traffic
Private networks
Protocol
Remote searching
Servers
Technology
Traffic
tunnel detection
Tunnels
Virtual private networks
Online AccessGet full text

Cover

More Information
Summary:Tunnels, a key technology of traffic obfuscation, are increasingly being used to evade censorship. While providing convenience to users, tunnel technology poses a hidden danger to cybersecurity due to its concealment and camouflage capabilities. In contrast to previous studies of encrypted traffic detection, we perform the first measurement study of tunnel traffic and its unique characteristics and focus on the challenges and solutions in detecting tunnel traffic among traditional and machine learning techniques. This study covers an almost twenty-year research period from 2003 to 2022. First, we present the concepts of two types of tunnels, broad and narrow tunnels, respectively, as well as a framework for major tunnel applications, such as Tor (the second-generation onion router), proxy, VPN, and their relationships. Second, we analyze state-of-the-art methods from traditional to machine learning applications to systematize tunnel traffic detection, including HTTP, HTTPS, DNS, SSH, TCP, ICMP and IPSec. A quantitative evaluation is presented with five crucial indicators applied to the detection methods and reviews. We further discuss the research work based on datasets, feature engineering, and challenges that have are solved, partly solved and unsolved. Finally, by providing open questions and the potential directions, we hope to inspire future work in this area.
ISSN:2076-3417
2076-3417
DOI:10.3390/app13031974