A Novel Lightweight Anonymous Proxy Traffic Detection Method Based on Spatio-Temporal Features

• Published in: Sensors (Basel, Switzerland) Vol. 22; no. 11; p. 4216
• Main Authors: He, Yanjie, Li, Wei
• Format: Journal Article
• Language: English
• Published: Switzerland MDPI AG 01.06.2022; MDPI
• Subjects: Algorithms; Analysis; Censorship; Classification; CNN; Computer crimes; Data security; Deep learning; Identification; Internet; Machine learning; Methods; Neural networks; Payloads; Safety and security measures; Shadowsocks traffic detection; spatio-temporal features; Virtual private networks; VPN traffic detection; China; CNN; Shadowsocks traffic detection; VPN traffic detection; spatio-temporal features
• DOI: 10.3390/s22114216
• ISSN: 1424-8220

Anonymous proxies are used by criminals for illegal network activities due to their anonymity, such as data theft and cyber attacks. Therefore, anonymous proxy traffic detection is very essential for network security. In recent years, detection based on deep learning has become a hot research topic, since deep learning can automatically extract and select traffic features. To make (heterogeneous) network traffic adapt to the homogeneous input of typical deep learning algorithms, a major branch of existing studies convert network traffic into images for detection. However, such studies are commonly subject to the limitation of large-sized image representation of network traffic, resulting in very large storage and computational resource overhead. To address this limitation, a novel method for anonymous proxy traffic detection is proposed. The method is one of the solutions to reduce storage and computational resource overhead. Specifically, it converts the sequences of the size and inter-arrival time of the first N packets of a flow into images, and then categorizes the converted images using the one-dimensional convolutional neural network. Both proprietary and public datasets are used to validate the proposed method. The experimental results show that the converted images of the method are at least 90% smaller than that of existing image-based deep learning methods. With substantially smaller image sizes, the method can still achieve F1 scores up to 98.51% in Shadowsocks traffic detection and 99.8% in VPN traffic detection.