Abstract: In recent years, security proxy has been utilized by more and more users to circumvent Internet censorship and access restricted resources. The classification of security proxy traffic is of great significance for network security and network management. In order to make up for the insufficiency of the existing deep packet inspection technology and improve firewall traffic detection capability, a secure proxy traffic classification method is proposed. The side-channel features used for security proxy traffic classification are extracted, including the payload length sequences and the signal sequence. Then based on these features, machine learning and deep learning algorithms are used to identify the traffic of widely used security proxies, including Shadowsocks, V2Ray, Freegate, and Ultrasurf. Experimental results show that compared with algorithms such as MLP and LSMP, the proposed traffic classification method provides higher accuracy, F1 value and other performance indicators.

Key words: secure proxy, traffic classification, machine leaning, deep learning, deep packet inspection

摘要： 安全代理被越来越多的互联网用户用于规避网络审查和访问受限资源，因此安全代理流量的分类对于网络安全和网络管理具有重要意义。为弥补深度包检测技术在过滤和识别不良信息上的不足，提高防火墙流量探测能力，提出一种安全代理流量分类方法。提取用于安全代理流量分类的侧信道特征，包括有效载荷长度序列、信号序列等，使用机器学习和深度学习算法对Shadowsocks、V2Ray、Freegate、Ultrasurf 4种被广泛使用的安全代理流量进行识别。实验结果表明，通过提取与有效载荷内容无关的侧信道特征进行分类，与MLP、LSMP等算法相比，该方法在准确率、F1值等性能方面均有提升。

关键词: 安全代理, 流量分类, 机器学习, 深度学习, 深度包检测

CLC Number: 

• TP309