A Multi-modal Learning-Based Behavior Identification Scheme for Obfuscated Tunneling Traffic

With the development of network proxy and traffic obfuscation, obfuscated tunneling tools such as V2Ray and Shadowsocks (SS) have been widely used to conceal malicious activities, posing new challenges to network security. To identify the various behaviors hiding in the obfuscated tunneling traffic, a multi-modal learning framework named CNPT-BiSSM is proposed in this study. In this framework, Convolutional Neural Pre-Normalized Transformer (CNPT) is utilized to learn multi-dimensional flow-level statistical features and Bi-directional State Space Model (BiSSM) is used to process the windowing packet length sequences. The overall latent representation of the traffic is then fed into an output layer to get the decision. Experiments were conducted on a real-world captured dataset containing 60,923 samples, encompassing five common types of data: E-mail, music, video, web, and live streaming. The experimental results show that the proposed scheme can achieve an average identification accuracy of 93.54%, outperforming existing state-of-the-art encrypted traffic classification methods.