Detecting VPN Traffic in Real-Time with Active Probing

Malicious attackers often exploit anonymity networks like VPNs to conceal their identities. This paper introduces a novel real-time detection algorithm based on discrepancies in packet round-trip times (RTTs) and active probing of VPN servers. When a client accesses a target server via a VPN, two distinct RTTs emerge anchored on the target: target-VPN and target-VPN-client. The proposed detection algorithm determines whether one or two significantly different RTT clusters are present, with two clusters indicating the use of a VPN. The focus of this study is the detection of Secure Shell (SSH) connections through VPNs. While measuring the RTT between the target and the client is relatively straightforward due to the packet exchange of the TCP/SSH protocol, estimating the RTT between the target and the VPN presents challenges. An active probing method is proposed to calculate the RTT, accounting for the potential involvement of a malicious or compromised VPN. By employing machine learning to analyze these RTTs, the system can effectively detect intruders utilizing VPNs. This research serves as a foundation for developing secure and efficient VPN detection systems, which are critical for preserving the integrity and privacy of digital resources.