Traffic Identification System Research Articles

ГІБРИДНИЙ МЕТОД АНАЛІЗУ ТА ІДЕНТИФІКАЦІЇ ШКІДЛИВОГО DOH-ТРАФІКУ

This study addresses the challenges associated with detecting DNS over HTTPS (DoH) traffic, a relatively new protocol that has not been extensively researched. The detection methods discussed include TLS inspection, application logging, and open-source tools such as Zeek and RITA. TLS inspection, which involves decrypting and analyzing traffic, is the most intrusive and requires full control over the network and client configurations. Application logging, such as that available in Mozilla Firefox, necessitates administrative control over client systems, which may be impractical. Zeek analyzes network logs to identify domains accessed without regular DNS queries, while JA3 fingerprints and RITA focus on detecting malicious DoH traffic by analyzing TLS handshake parameters and beacon-like activities, respectively. Additionally, maintaining up-to-date blacklists of IP addresses and SNI values can help identify DoH traffic but faces scalability and evasion challenges. The study highlights that no current solution is entirely feasible, with many requiring excessive administrative overhead or failing to scale effectively. A hybrid approach using machine learning models and traffic analysis, as illustrated by the CIRA-CIC-DoHBrw-2020 dataset, is proposed for more effective detection of malicious DoH traffic. This approach involves the architecture of a two-stage DoH traffic identification system is presented, consisting of three subsystems: traffic, training and evaluation, and identification. They operate sequentially, with the system's function being traffic identification, training, testing, and information processing within the DoH protocol. The next step is process of cross-validation, which involves training a machine learning model K times, with each iteration using a different fold as the validation set, while the remaining folds serve as the training set. The aim of this work: Development and implementation a DoH traffic identification system, which, unlike existing solutions, is based on a hybrid approach to identifying malicious traffic using open tools for detecting encrypted DNS traffic and specialized machine learning models.

STI: A self-evolutive traffic identification system for unknown applications based on improved random forest

Artificial intelligence technology has proven potential and effective in traffic identification for network management and security. However, the accuracy of its identification is easily influenced by the massive unknown traffic. Given the fact of numerous unknown applications in real networks and even more as time goes by, a promising traffic identification system should have the ability to discover unknown applications and recognize their traffic. In this paper, an innovative and comprehensive traffic identification system, called STI, is proposed, which can achieve fulfilling high precision both on known and unknown traffic identification. More importantly, STI can self-evolve to identify incoming unknown applications and corresponding training samples based on a novel clustering process with minimal manual involvement. In addition, an improved random forest and a novel similarity calculation method are proposed and applied to STI to enhance the classification performance. Experiments on real network traffic demonstrate the core advantages of the proposed system.

A VPN-Encrypted Traffic Identification Method Based on Ensemble Learning

One of the foundational and key means of optimizing network service in the field of network security is traffic identification. Various data transmission encryption technologies have been widely employed in recent years. Wrongdoers usually bypass the defense of network security facilities through VPN to carry out network intrusion and malicious attacks. The existing encrypted traffic identification system faces a severe problem as a result of this phenomenon. Previous encrypted traffic identification methods suffer from feature redundancy, data class imbalance, and low identification rate. To address these three problems, this paper proposes a VPN-encrypted traffic identification method based on ensemble learning. Firstly, aiming at the problem of feature redundancy in VPN-encrypted traffic features, a method of selecting encrypted traffic features based on mRMR is proposed; secondly, aiming at the problem of data class imbalance, improving the Xgboost identification model by using the focal loss function for the data class imbalance problem; Finally, in order to improve the identification rate of VPN-encrypted traffic identification methods, an ensemble learning model parameter optimization method based on optimal Bayesian is proposed. Experiments revealed that our proposed VPN-encrypted traffic identification method produced more desirable VPN-encrypted traffic identification outcomes. Meanwhile, using two encrypted traffic datasets, eight common identification algorithms are compared, and the method appears to be more accurate in identifying encrypted traffic.

Identifying Ethereum traffic based on an active node library and DEVp2p features

With the prevalence of blockchain technology, Ethereum, as the second-largest blockchain, with the capabilities of running smart contracts, grows fast. A user on the Ethereum platform can implement smart contracts as well as remit its cryptocurrency. Cyber-attacks often target cryptocurrency. Besides, Ethereum may be exploited by malicious users for launching attacks. Therefore, the demand for Ethereum network supervision is increasing. To protect interior users on Ethereum from attacks, an Internet Service Provider (ISP) should supervise the Ethereum traffic from or to its internal users. Ethereum traffic identification is the first step towards supervision. Ethereum is a peer-to-peer communication network implemented by DEVp2p. DEVp2p is designed to realize data interaction and adopts encryption to enhance anonymity on Ethereum. It is difficult to identify Ethereum traffic accurately at line speed in a high-speed network. So far, Ethereum traffic identification has not been explored yet. This paper designs an efficient Ethereum traffic identification system with high identification accuracy, dubbed ETI (Ethereum Traffic Identification), for an ISP to supervise its internal users on Ethereum without Deep Packet Inspection (DPI). ETI first constructs an active node library consisting of core nodes on Ethereum and active Ethereum peers in the ISP. Then potential Ethereum flows are filtered by checking if their sources or destinations are in the active node library. As active Ethereum nodes may generate non-Ethereum traffic, machine learning classifiers are further adopted to judge if the potential Ethereum traffic is actually from Ethereum. The classification is based on the unique packet/payload-length and port number-related traffic features on Ethereum implemented by DEVp2p. Our experimental studies validate that ETI outperforms state-of-the-art network traffic classification methods in identification accuracy and time efficiency. ETI achieves an identification accuracy of 0.9998 and relatively high time efficiency.

SSAPPIDENTIFY: A robust system identifies application over Shadowsocks’s traffic

As an effective tool for penetrating firewalls and bypassing supervision and censorship, Shadowsocks is widely used, and there are also illegal network activists. If there is a traffic identification system that can identify applications over Shadowsocks, it can greatly facilitate the supervision, traceability, and evidence collection of cybercrime activities. In this paper, we propose an application over Shadowsocks’s traffic identification system, which adds the sliding window JS divergence feature on the basis of the traditional statistics and distribution based on traffic packet length and timestamp. This feature can effectively reduce the impact on smart phone differences without reducing the accuracy of the same individual device application traffic recognition, while maintaining the characteristics of the application as much as possible, thereby greatly improve our traffic recognition the robustness of the system. Experimental results show that our system can achieve an accuracy of 94.5% on the same smart phone. On the data sets collected by different smart phones, our work has achieved an accuracy of 80.4%, which has certain practicality.

A Design and Implementation of P2P Network Traffic Identification System

The P2P streaming media technology is popular and promising in recent years, to ensure the correctness of the identification method, and improve the identification rate and accuracy of the network traffic, this paper proposes a identification principle and algorithm of the P2P network traffic, and gives the overall structure of the system, Finally, puts up the system test environment. The experimental results show that the identification method of the network traffic proposed in this paper can effectively improve the identification rate and accuracy of the network traffic, the scheme has the value of further research and promotion.

Implementation of P2P Traffic Identification System

By analyzing packets of the transport layer and the traffic flow statistic characteristics in the peer-to-peer (P2P) applications, a new P2P traffic identification system is presented. The new method in the system relies on the observation of the first few data packets of a TCP/UDP connection. It not only can identify more P2P applications, but also can identify the known and unknown P2P applications even if the data of them is encrypted. According to the results by passing a large number of tests, the system has higher identify-rate to identify the P2P applications and lower false negative and false positive. It has good effects in the actual network.

A SVM Method for P2P Traffic Identification based on Multiple Traffic Mode

Support Vector Machines (SVM) algorithms are one of the algorithm s currently applied in Deep Traffic Inspection (DFI) technologies. This paper realizes online real-time traffic information detection, provides a P2P traffic identification system that supports online SVM analysis and offline SVM training function, and demonstrates the thinking of different identification for IP data traffic and IP-Port data traffic. This paper designs different combinations of traffic features for IP data traffic and IP-Port data traffic, analyzes the effectiveness and exactness of these combinations from various function criteria, and based on a lot of experiments, obtains a best SVM kernel function and a combination of parameters that match es the very combination of traffic features.