VPN Traffic Classification Based on Payload Length Sequence
Ping Gao, Guangsong Li, Yanan Shi, Yan Wang · 2020
In order to circumvent Internet censorship, more and more malicious users utilize Virtual Private Network (VPN) software to penetrate firewall and access restricted resources. It's important to identify and classify VPN traffic for network management and security. In this paper, 6 different kinds of VPN traffic are analyzed. Characterizing VPN traffic by Sample Entropy Fingerprint and Payload Length Sequence (PLS) separately, we apply Machine Learning (ML) algorithms to construct VPN traffic classifiers basing on these features. Comparing with Deep Packet Inspection (DPI), Sample Entropy Fingerprint and PLS, our result shows that the classifier based on PLS can achieve accurate VPN traffic classification, including obfuscated VPN traffic.