Abstract: While novel mainstream domestic V2Ray-type encrypted proxy protocols protect user privacy, covert channels are provided for cybercrime. Accurate identification of such traffic has become a new research hotspot in cyberspace governance. To evade regulation, these protocols often employ traffic variant techniques, making them more camouflaged and difficult for existing methods to detect effectively. To address this issue, an encrypted proxy traffic detection model is proposed, AG-CTNet, based on dynamic fusion of multimodal features, to identify V2Ray-type encrypted proxy traffic employing various camouflage strategies. To address the scarcity of existing public datasets, an encrypted proxy traffic sample library is constructed through independent data collection and introduce data augmentation strategies to improve model robustness. For the traffic variant camouflage problem, a parallel fusion architecture of 2D-CNN and Transformer is adopted, innovatively introducing cross-modal attention and dynamic gating mechanisms to achieve adaptive fusion of multimodal features. Experimental results show that the model in this paper achieves an accuracy of 98.62% and a precision of 98.41% for identifying V2Ray-type encrypted proxy traffic, effectively improving the accuracy of traffic identification.

摘要： 新型国内主流V2Ray类加密代理协议在保护用户个人隐私的同时也为网络犯罪活动提供了隐蔽通道，准确识别此类流量已成为网络空间治理的研究新热点。为躲避监管，此类协议通常采用流量变种技术，伪装性更强，现有方法难以有效检测。针对这一问题，提出一种基于多模态特征动态融合的加密代理流量检测模型AG-CTNet，用于识别采用多种伪装策略的V2Ray类加密代理流量。针对现有公开数据集稀缺问题，通过自主采集数据，构造加密代理流量样本库，同时引入数据增强策略，提升模型鲁棒性；针对流量变种伪装问题，采用2D-CNN与Transformer并行融合架构，创新性地引入跨模态注意力和动态门控机制，实现多模态特征自适应融合。实验结果表明，本文模型对于V2Ray类加密代理流量识别的准确率和精确率分别达到98.62%、98.41%，有效提升了流量识别的准确性。