Dual-view Traffic Identification for Open Source Proxy Software through Early Flows
Yuwei Xu, Yunpeng Bai, Yuquan Zhang, Yige Song, Qiao jun Xiang, Guang Cheng · 2024
Open Source Proxy Software (OSPS) provides privacy protection for users accessing the Internet by constructing a private anonymizing network. However, there is a growing concern about whether OSPS can actually prevent privacy leaks as it claims. Researchers have attempted to use AI-based techniques to identify OSPS, but there are two shortcomings in the current studies. First, there is no complete public dataset to support the identification tasks for different requirements. The existing datasets do not cover the most commonly used OSPS tools and their typical configurations. Second, with the introduction of deep learning techniques, the models continue to become complex, resulting in significant computational overhead. Using early flows for identification may make the model lighter, but result in weaker representations and lower classification performance. To address the above shortcomings, we have carried out pioneering work on OSPS traffic identification through early flows. First, we collect the access traffic of three OSPS tools and create a dataset with 8 protocol configurations. Second, we present an innovative Dual-View Identification (DVI) method for OSPS traffic. By considering both static and dynamic views, DVI effectively characterizes early flows and achieves accurate classification through feature fusion. In the static view, spatial distribution features are extracted by representing the early flows as a grayscale picture. In the dynamic view, spatial features and temporal correlations are represented using a flow with multiple packets, similar to a video with multiple frames. Comparative experiments show that DVI achieves over 90% accuracy and F1 scores in all three tasks, which greatly improves its ability to identify different protocol configurations and access sites. Besides, DVI outperforms 5 state-of-the-art methods and achieves low parameters and FLOPS through early flows.