Together may be better: A novel framework and high-consistency feature for proxy traffic analysis

Abstract

Encrypted and proxy-based traffic has been critical in ensuring communication security but also pose significant challenges for traffic analysis, such as obscured traffic patterns, the inability to correlate pre- and post-proxy flows, and the increased complexity of analyzing encapsulated data. To address these challenges and enable comprehensive proxy traffic analysis, this paper proposes TrafficTracer, a novel proxy traffic capturing framework designed to overcome limitations in existing methods, such as port-missing issues and the inability to correlate pre- and post-proxy traffic. By modifying the open-source proxy application Clash, TrafficTracer extracts inner connection information, enabling complete traffic flow tracing. Furthermore, building on the whole-procedure proxy traffic captured by TrafficTracer, we design Flow Reversals (FR), a robust feature capturing the consistency of traffic flow characteristics before and after proxy encapsulation. Experimental evaluations demonstrate that TrafficTracer significantly enhances raw packet capture efficiency and alleviates port-missing issues. Moreover, FR exhibits strong proxy feature invariability and temporal consistency, outperforming traditional features in maintaining pre- and post-proxy traffic correlations. These results indicate that leveraging TrafficTracer and FR can effectively facilitate the analysis of the entire proxy traffic procedure and hold promise for traffic analysis performance improvement.