Ultra Surf Flow Detection Based on Statistical Classification

Abstract:

Unbounded browsing software is an application worked in Internet client. It uses a custom encryption protocol to break the traditional network filtering. In this paper, we can detect this application through classifying the Ultra Surf T mode (TCP packets) packets and using SPID. The experimental results show that we can effectively reduce the false alarm rate and detect the application accurately by classifying the Ultra Surf T mode (TCP packets) packets and using SPID.

• Periodical: Applied Mechanics and Materials (Volumes 713-715)
• Pages: 495-499
• DOI: https://doi.org/10.4028/www.scientific.net/AMM.713-715.495
• Online since: January 2015
• Authors: Xun Yi Ren*, Han Qing Hu
• Keywords: Classifying Recognition, SPID, Ultra Surf

References

[1] Besikas C, Mantar H A, Real-Time traffic classification based on cosine similarity using sub-application vectors, Traffic Monitoringamd Analysis, Springer Berlin Heidelberg, 2012, pp.89-92.

DOI: 10.1007/978-3-642-28534-9_10

[2] Fan Chen, DawuGu. Reverse analysis software FreeGate, The twenty-third National Computer Security Symposium, (2008).

[3] Information on http: /iptables- tutorial. frozentux. net/iptables-tutorial. html.

[4] Sharpe Richard, Warnicke Ed, and Lamping Ulf, Ethereal User's Guide V2. 00 for Ethereal 0. 10. 5. http: /www. rootsecure. net/ content/downloads/pdf/ethereal_guide. pdf, (2004).

[5] Feitian, Software encryption principle and Application. Beijing: Publishing House of electronics industry, (2004).

[6] KARAGIANNIS TBROIDO AFALOUYSOS M. Transport layer identification of P2P traffic, Proceedings of the 4th ACM SIGCOMM Conference on Internet Measurement. New York , 2004, pp.121-134.

DOI: 10.1145/1028788.1028804

[7] IANA. PORT NUMBERS http: /www. iana. org/assignment/service-names-port-numbers/service-names-port-numbers. xml.

DOI: 10.17487/rfc6335

[8] Liang Chen, Jian Gong. The application layer protocol identification algorithm overview. Computer science, 34 (2007): 73-75.

[9] Hjelmvik E and John W. Breaking and Improving Protocol Obfuscation. Department of Computer Science and Engineering, Chalmers University of Technology, Technical Report, (2010).

[10] Hjelmvik E. Document of Statistical Protocol Identification AttributeMeters. http: /sourceforge. net/apps/mediawiki/spid/index. php?title=AttributeMeters.

[11] M. Zhang, W. John, K. Claffy, and N. Brownlee, State of the art intraffic classification: A research review, PAM Student Workshop, (2009).

[12] W. John and S. Tafvelin, Heuristics to classify internet backbone trafficbased on connection patterns, ICOIN, (2008).

DOI: 10.1109/icoin.2008.4472818

[13] B. -C. Park, Y. J. Win, M. -S. Kim, and J. W. Hong., Towards automatedapplication signature generation for traffic identification, NOMS, (2008).

[14] E. Bursztein, Probabilistic identification for hard to classify protocol, in WISTP, (2008).

[15] Yinhui L, Jingbo X, Silan Z, et al. An efficient intrusion detection system based on support vector machines and gradually feature removal method. Expert Systems with Applications, 39 (2012): 424–430.

DOI: 10.1016/j.eswa.2011.07.032