Tunnel User Behavior Identification Based on Self-Supervised Pre-Training

With the widespread use of tunnel technology, the volume of encrypted tunnel traffic is rapidly increasing. Malicious users can transmit harmful information secretly through tunnels to bypass firewall censorship. Therefore, developing effective techniques to identify tunnel user behaviors is crucial. However, current efforts in tunnel traffic classification primarily focus on coarse-grained application identification and encounter the problem of insufficient extraction of tunnel traffic feature information. In this paper, we refine the previous tunnel traffic identification granularity from prevalent application identification to behavior identification, and propose TF-Net, a novel deep learning framework for fine-grained identification of tunnel user behaviors. TF-Net extracts features from raw bytes, packet length sequence, packet time interval sequence of tunnel traffic. It employs self-supervised pre-training to learn contextual distributions of raw bytes from unlabeled datasets, thereby enhancing the model’s ability to characterize packets in a tunnel flow. Moreover, we fine-tune the model based on the classification objectives of different tasks to achieve more versatile and accurate tunnel identification. Comprehensive experiments are conducted on three real-world encrypted tunnel traffic datasets, demonstrating that TF-Net achieves outstanding performance and outperforms state-of-the-art methods.