Method for identifying Shadowsockets (R) based on protocol attributes

Abstract

The invention discloses a Shadowsockets (R) identification method based on protocol attributes, and the method comprises the steps: carrying out the analysis and extraction of identification features based on the Shadowsockets (R) protocol attributes after traffic collection, and forming self-created features; after machine learning-based model training is performed on the self-created features, an identification result is output; according to the method, the Shadowsockets (R) traffic in various environments (a laboratory environment, an internet real network environment and the like) can be effectively and accurately identified.

Description

technical field [0001] The invention relates to the field of traffic identification, and more particularly, to a method for identifying Shadowsocks (R) based on protocol attributes and machine learning based on protocol attributes. Background technique [0002] With the development of Internet technology, VPN protocols or application software such as VPN or private proxy emerge in an endless stream. The early VPN protocols mainly focus on PPTP, IPSec, Openvpn, SSH, etc., but PPTP, IPSec, Openvpn, SSH use fixed ports and standardized protocol, so it is easy to be blocked. Although blue light, Expressvpn, Tor and other paid VPN software can be used, they are very unstable. Shadowsocks(R) is a Socks5-based VPN proxy software developed by the clowwindy team. Shadowsocks(R) is the collective name of two private proxy protocols, Shadowsocks and ShadowsocksR. Because it improves the drawbacks of other VPN software, it has fast speed, The advantages of flexible encryption, cross-p...

AI Technical Summary

Problems solved by technology

[0010] There are not many researches on Shadowsocks(R) traffic identification at home and abroad, which may have a lot to do with the difficulty and sensitivity of the technology. At present, there are few public research results, and most of the actual attack cases are implemented Engineering aspects such as code defects

Most of the known Shadowsocks(R) traffic identification-related articles are based on machine learning. Shadowsocks(R) is a privatized software. Common features cannot reflect the privacy of the protocol. Machine learning based on common features The method is not universal, and it is difficult to accurately identify Shadowsocks(R) using only one technology

At present, there are basically no Shadowsocks(R) identification methods based on protocol attributes that combine protocol analysis, machine learning and other technologies.

Images