TunnelScanner: A Novel Approach For Tunnel Mixed Traffic Classification Using Machine Learning
Panpan Zhao, Zhen Li, Mingxin Cui, Jie Lu, Gang Xiong, Gaopeng Gou · 2021
With the explosive growth in the use of tunneling protocols, network management and network security are facing huge challenges. Tunnel traffic classification is the most basic step to maintain network security. The studies on the classification of tunnel traffic is mainly divided into machine learning methods and deep learning methods. However, existing studies only focus on the identification of a single application of the tunnel, assuming that the user only uses one application in the tunnel. Unfortunately, the assumption of a single application is not reasonable in the tunnel. The user may use lots of applications within a time in the tunnel. Moreover, the application traffic is mixed and overlapped in the tunnel. As a solution, we propose TunnelScanner, a novel framework for the identification of two mixed applications in the tunnel. We extracted novel features named maxcum from the tunnel mixed traffic, and then input the extracted features into the traditional machine learning model to train the classifier, to achieve high accuracy and low training overhead. We collected nine types of mixed traffic in three types of tunnels (SSH, SSL, L2TP) to verify the effectiveness of TunnelScanner. The experimental results demonstrate that TunnelScanner is superior to the state-of-the-art methods in terms of accuracy, recall, and stability.