Research on ShadowsocksR Traffic Identification Based on DART Algorithm

Shadowsocks (SS) is a new popular anonymous communication software in recent years. The traffic generated by SS is very difficult to identify. There is also an enhanced version of SS, called ShadowsocksR(SSR), which can disguise SS traffic as traditional protocol traffic, such as HTTP traffic, TLS t...

Full description

Saved in:
Bibliographic Details
Published in2021 7th Annual International Conference on Network and Information Systems for Computers (ICNISC) pp. 666 - 672
Main Authors Ji, Qingbing, Deng, Xiaoyan, Ni, Lulin
Format Conference Proceeding
LanguageEnglish
Published IEEE 01.07.2021
Subjects
Classification algorithms
Computers
DART
Feature extraction
Machine learning
Machine learning algorithms
Protocols
ShadowscoksR
Software
traffic identification
Online AccessGet full text
DOI10.1109/ICNISC54316.2021.00126

Cover

More Information
Summary:Shadowsocks (SS) is a new popular anonymous communication software in recent years. The traffic generated by SS is very difficult to identify. There is also an enhanced version of SS, called ShadowsocksR(SSR), which can disguise SS traffic as traditional protocol traffic, such as HTTP traffic, TLS traffic, etc. This makes the identification of SS traffic more difficult. In reference [16], an identification method of HTTP camouflaging traffic of SS is proposed for the first time. Here, a new identification method is proposed based on dart algorithm. Compared with reference [16], this method has more types and wider range of SSR obfuscated traffic, and has better identification effect for recent SSR obfuscated traffic, with the accuracy, the recall and the precision are all above 98.5%.
DOI:10.1109/ICNISC54316.2021.00126