Research and Application of Network Anonymous Traffic Detection Method Based on Deep Forest

doi:10.3969/j.issn.1671-1122.2022.08.008

Abstract

Abstract:

Traffic classification has been the subject of many research studies. The widespread use of encryption make it an open technical challenge. Data encryption is a key technology used in various privacy enhancing tools. Among them, The darknet based on Tor anonymous communication system is the largest anonymous communication entity today, It is often used by criminals to engage in various illegal and criminal activities. Therefore, efficient identification and recognition of Tor traffic is of great significance. According to the characteristics of Tor anonymous traffic, this paper designs a set of network flow characteristics for Tor traffic behavior detection. To address the shortcomings of the original deep forest model in terms of memory and time overheads, this paper proposes an improved deep forest model for Tor network traffic identification. The experimental results show that, compared with the existing recognition methods, the proposed model can achieve 99.86% accuracy, and the detection time overhead and memory requirements are optimized.

Key words: traffic classification, Tor darknet, anonymized traffic, deep forest

CLC Number:

TP309

WEI Songjie, LI Chenghao, SHEN Haotong, ZHANG Wenzhe. Research and Application of Network Anonymous Traffic Detection Method Based on Deep Forest[J]. Netinfo Security, 2022, 22(8): 64-71.

Figures/Tables 11

References 17

[1]	DINGLEDINE R, MATHEWSON N, SYVERSON P. Tor: The Second-Generation Onion Router[EB/OL].[ 2022-04-01]. https://xueshu.baidu.com/usercenter/paper/show?paperid=2ebc60ffb4dcd902c75ec2184eaf3e20.
[2]	SAPUTRA F A, NADHORI I U, BARRY B F. Detecting and Blocking Onion Router Traffic Using Deep Packet Inspection>:[C]// IEEE. International Electronics Symposium (IES). New York: IEEE, 2016283-288.
[3]	LASHKARI A H, DRAPER-GIL G, MAMUN M S I, et al. Characterization of Tor Traffic Using Time Based Features[EB/OL]. (2017-09-29) [2022-04-01] https://www.researchgate.net/publication/314521450_Characterization_of_Tor_Traffic_using_Time_based_Features.
[4]	MADHUKAR A, WILLIAMSON C. A Longitudinal Study of P2P Traffic Classification[C]// IEEE. International Symposium on Modeling, Analysis, and Simulation. New York: IEEE, 2006: 179-188.
[5]	MOORE A W, PAPAGIANNAKI K. Toward the Accurate Identification of Network Applications[C]// Springer. International Workshop on Passive and Active Network Measurement. Berlin: Springer, 2005: 41-54.
[6]	LIU X B, YANG J H, XIE G G, et al. Automated Mining of Packet Signatures for Traffic Identification at Application Layer with Apriori Algorithm[EB/OL]. [ 2022-04-01]. https://xueshu.baidu.com/usercenter/paper/show?paperid=94fc3e9c8f42718fc085cc0e299e78db&site=xueshu_se&hitarticle=1.
[7]	ESTE A, GRINGOLI F, SALGARELLI L. Support Vector Machines for TCP Traffic Classification[J]. Computer Networks, 2009, 53(14): 2476-2490. doi: 10.1016/j.comnet.2009.05.003 URL
[8]	SAHU S, MEHTRE B M. Network Intrusion Detection System Using J48 Decision Tree[C]// IEEE. International Conference on Advances in Computing, Communications and Informatics (ICACCI). New York: IEEE, 2015: 2023-2026.
[9]	HELMAN P, VEROFF R, ATLAS S R, et al. A Bayesian Network Classification Methodology for Gene Expression Data[J]. Journal of Computational Biology, 2004, 11(4): 581-615. doi: 10.1089/cmb.2004.11.581 URL
[10]	DOGRU N, SUBASI A. Traffic Accident Detection Using Random Forest Classifier[C]// IEEE. 15th Learning and Technology Conference (L&T). New York: IEEE, 2018: 40-45.
[11]	LI Xiaoming, REN Hui, YAN Jinyao. Analysis and Research on Network Traffic Classification Algorithm Based on Machine Learning[J] Journal of Communication University of China: Natural Science Edition, 2017, 24(2): 9-14.
	李晓明, 任慧, 颜金尧. 基于机器学习的网络流量分类算法分析研究[J]. 中国传媒大学学报:自然科学版, 2017, 24(2): 9-14.
[12]	WANG Pan, YE Feng, CHEN Xuejiao, et al. Datanet: Deep Learning Based Encrypted Network Traffic Classification in SDN Home Gateway[J]. IEEE Access, 2018, 6: 55380-55391. doi: 10.1109/ACCESS.2018.2872430 URL
[13]	ZHOU Zhihua, FENG Ji. Deep Forest[J]. National Science Review, 2019, 6(1): 74-86. doi: 10.1093/nsr/nwy108
[14]	PANG M, TING K M, ZHAO P, et al. Improving Deep Forest by Confidence Screening[C]// IEEE. IEEE International Conference on Data Mining (ICDM). Piscataway: IEEE, 2018: 1194-1199.
[15]	BLUMBERG B, DOWNIE M, IVANOV Y, et al. Integrated Learning for Interactive Synthetic Characters[C]//ACM. Proceedings of the 29th Annual Conference on Computer Graphics and Interactive Techniques. New York: ACM, 2002: 417-426.
[16]	ZHOU Zhi Hua, FENG Ji. Deep Forest: Towards An Alternative to Deep Neural Networks[EB/OL]. [ 2022-04-01]. https://xueshu.baidu.com/usercenter/paper/show?paperid=637f02600a538dc721ff4c3213ce2b7a&site=xueshu_se.
[17]	MA Pengfei, WU Youxi, LI Yan, et al. DBC-Forest: Deep Forest with Binning Confidence Screening[J]. Neurocomputing, 2021(12): 112-122.

特征	相关度
Flow Bytes/s	0.8778
Flow Duration	0.8745
Fwd IAT Mean	0.7135
Bwd IAT Mean	0.7134
Flow IAT Std	0.7034
Fwd IAT Min	0.6961
Flow IAT Mean	0.6921
Bwd IAT Min	0.6874
Idle Max	0.6868
Idle Min	0.6755
Idle Mean	0.6726
Flow Bytes/s	0.6692
…	…

特征属性	描述
Flow Bytes/s	每秒流字节数
Flow Duration	流持续时间
Fwd IAT mean/max/min/std	正向流中包到达间隔的mean/max/min/std
Bwd IAT mean/max/min/std	反向流中包到达间隔的 mean/max/min/std
Fwd Packet Length mean/max/min/std	正向流中包长度的 mean/max/min/std
Bwd Packet Length mean/max/min/std	反向流中包长度的 mean/max/min/std
Flow IAT mean/max/min/std	包到达间隔时间的 mean/max/min/std
Active mean/max/min/std	流变为空闲态之前活动时间的 mean/max/min/std
Idle mean/max/min/std	流变为活动态之前空闲时间的 mean/max/min/std
Total Fwd Packet	正向数据包总数
Total Bwd packets	反向数据包总数
Total Length of Fwd Packet	正向数据包总大小
Total Length of Bwd Packet	反向数据包总大小
Flow Packets/s	每秒流数据包数

类别	版本
处理器	Intel(R) Core(TM) i5-6300 CPU
显卡	NVIDIA GeForce GTX 960M
Python3	3.7
Tensorflow	2.8.0
Scikit-learn	1.0.2

流超时值/s	Tor	nonTor	总计
2	32901	162552	195453
4	17556	137155	154711
8	9713	102970	112683
16	5329	86495	91824
32	2924	69633	72557
64	1626	61012	62638
128	930	57655	58585

方法	准确率	精确率	F1-Score	召回率	训练时长/s	测试时长/s	内存开销 /MB	流超时时间/s
gcCS	99.90%	99.24%	98.96%	98.68%	189.54	11.94	24.67	2
gc	99.90%	99.62%	99.20%	98.78%	692.11	29.06	25.14	2
gcCS	99.85%	99.56%	99.40%	99.24%	197.87	3.89	20.84	4
gc	99.87%	99.67%	99.48%	99.3%	467.00	21.25	25.55	4
gcCS	99.83%	99.62%	99.46%	99.54%	159.12	3.20	20.02	8
gc	99.85%	99.68%	99.59%	99.51%	378.96	20.94	23.125	8
gcCS	99.86%	99.82%	99.72%	99.62%	114.92	2.72	20.00	16
gc	99.87%	99.82%	99.68%	99.75%	291.86	32.57	22.60	16
gcCS	99.85%	98.61%	97.61%	96.93%	213.00	8.76	20.14	32
gc	99.89%	98.96%	98.37%	97.78%	259.00	29.43	23.09	32
gcCS	99.85%	98.76%	96.67%	94.66%	162.98	6.42	20.09	64
gc	99.85%	98.46%	96.68%	94.96%	148.86	17.75	21.13	64
gcCS	99.85%	94.39%	95.36%	96.35%	166.86	2.80	22.04	128
gc	99.90%	96.88%	96.88%	96.88%	141.00	24.55	22.18	128