VPN Traffic Identification Based on Tunneling Protocol Characteristics

Abstract

Virtual Private Network (VPN) provides a secure, encrypted, and anonymous communication between remote networks. More and more people are inclined to use, with the raising network security and privacy protection awareness. However, VPNs are also widely abused by malicious pursuers, and thereby distinguishing VPN traffic for father judgment is of the utmost importance for network supervision. In this paper, we focus on the characteristics of VPN tunneling protocols, and then extract four categories of traffic features, including two novel entropy features, for VPN traffic identification. Feature evaluation upon real-world VPN traffic demonstrates, that all these features can notably embody differences between VPN and Non-VPN traffic, and the entropy features work still well even when applications traffic is mixed. Finally, the proposed VPN traffic identification method achieves the accuracy of 99.02% and 95.32% respectively on self-gathered and public VPN datasets, remarkably higher than the existing research.