The Random Forest Based Detection of Shadowsock's Traffic

Deng, Ziye; Liu, Zihan; Chen, Zhouguo; Guo, Yuan

doi:10.1109/ihmsc.2017.132

Cited by 19 publications

(18 citation statements)

References 2 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In order to verify the validity of the method, we compare it with the classification methods proposed in literature [44] and literature [25]. There are two main reasons we choose these two methods for comparative experiments.…”

Section: ) Comparison With Other Methodsmentioning

confidence: 99%

“…In the few researches about SS traffic, most of them are the identification of specific websites and web pages on SS traffic based on fingerprint attacks [42], [43]. To the best of our knowledge, only Deng et al proposed a random forest-based SS detection method in 2017 [44]. The method extracts more than 3000 features from bidirectional flows and network packets host profile, and the detection rate reaches 85% or more on the experimental data set.…”

Section: B Encrypted and Anonymous Traffic Identificationmentioning

confidence: 99%

See 1 more Smart Citation

Flow Context and Host Behavior Based Shadowsocks’s Traffic Identification

et al. 2019

View full text Add to dashboard Cite

Cloud Virtual Private Server (VPS) services provide the chance of rapid deployment of anonymous proxy services, becoming an important part of many anonymous proxy solutions. The anonymous system represented by ShadowSocks (SS), through proxy services deployed on VPSs provided by different cloud service providers, has become an important mean for illegal network activists to engage in illegal network activities such as cyber-attacks and darknet transactions. It is difficult for local network administrators to supervise SS traffic from the cloud. While from the local network, the task faces the challenges of Invisible Negotiation Process and Data Transparent Transmission. In this paper, we present a novel SS detection method based on flow context and host behavior. The method can not only accurately identify SS flows, but also be applicable to a large-scale network environment. In this method, we extract 12-dimensional features from three aspects: the relationship between flows, hosts' flow behavior, and hosts' DNS behavior to build the detection model. Among them, the four features about flow burst and the feature of unassociated domain names' number are innovatively proposed in this paper. Moreover, the big data statistical and association techniques are used in the method. To verify the effectiveness of the method, we first built a real SS running environment based on the campus network and two VPSs on two different public cloud platforms. Moreover, we conduct a series of experiments on the NTCI-BDP data platform which is a big data platform built by our team. The experimental results show that our method achieves 93.43% accuracy on experimental data sets and can effectively identify SS traffic.INDEX TERMS Big Data association, cloud-based anonymous proxy, flow burst, flow context, host behavior, traffic identification, shadowsocks.

show abstract

Section: ) Comparison With Other Methodsmentioning

confidence: 99%

Section: B Encrypted and Anonymous Traffic Identificationmentioning

confidence: 99%

Flow Context and Host Behavior Based Shadowsocks’s Traffic Identification

et al. 2019

View full text Add to dashboard Cite

show abstract

“…The correlation of the AMPs property and structural descriptors to their activity levels were modeled with the random forest algorithm (Ho, 1995) as implemented in the Weka data mining software (Witten et al, 2016). Random forest was selected as the modeling algorithm for a number of reasons as follows: (a) demonstrated robust prediction performance in wide range of domains ranging from signal processing (Deng et al, 2017) to social sciences (Araque et al, 2017), (b) relative insensitivity to initialization parameters, (c) usage familiarity by our group, (d) capable of computing molecular descriptor importance via the mean decrease of entropy (Breiman, 2001) (more on molecular descriptors is found at the end of this section). For a detailed description of the prediction modeling process, the book (Kuhn & Johnson, 2013) is suggested.…”

Section: Methodsmentioning

confidence: 99%

Toward insights on determining factors for high activity in antimicrobial peptides via machine learning

Li¹,

Nantasenamat²

2019

PeerJ

View full text Add to dashboard Cite

The continued and general rise of antibiotic resistance in pathogenic microbes is a well-recognized global threat. Host defense peptides (HDPs), a component of the innate immune system have demonstrated promising potential to become a next generation antibiotic effective against a plethora of pathogens. While the effectiveness of antimicrobial HDPs has been extensively demonstrated in experimental studies, theoretical insights on the mechanism by which these peptides function is comparably limited. In particular, experimental studies of AMP mechanisms are limited in the number of different peptides investigated and the type of peptide parameters considered. This study makes use of the random forest algorithm for classifying the antimicrobial activity as well for identifying molecular descriptors underpinning the antimicrobial activity of investigated peptides. Subsequent manual interpretation of the identified important descriptors revealed that polarity-solubility are necessary for the membrane lytic antimicrobial activity of HDPs.

show abstract

Section: Multivariate Analysismentioning

confidence: 99%

Peer Review #2 of "Toward insights on determining factors for high activity in antimicrobial peptides via machine learning (v0.2)"

2019

View full text Add to dashboard Cite

The continued and general rise of antibiotic resistance in pathogenic microbes is a wellrecognized global threat. Host defense peptides (HDPs), a component of the innate immune system have demonstrated promising potential to become a next generation antibiotic effective against a plethora of pathogens. While the effectiveness of antimicrobial host defense peptides (AMPs) has been extensively demonstrated in experimental studies, theoretical insights on the mechanism by which these peptides function is comparably limited. In particular, experimental studies of AMP mechanisms are limited in the number of different peptides investigated and the type of peptide parameters considered. This study makes use of the random forest algorithm for classifying the antimicrobial activity as well for identifying molecular descriptors underpinning the antimicrobial activity of investigated peptides. Subsequent manual interpretation of the identified important descriptors revealed that polarity-solubility are necessary for the membrane lytic antimicrobial activity of HDPs.

show abstract

The Random Forest Based Detection of Shadowsock's Traffic

Cited by 19 publications

References 2 publications

Flow Context and Host Behavior Based Shadowsocks’s Traffic Identification

Flow Context and Host Behavior Based Shadowsocks’s Traffic Identification

Toward insights on determining factors for high activity in antimicrobial peptides via machine learning

Peer Review #2 of "Toward insights on determining factors for high activity in antimicrobial peptides via machine learning (v0.2)"

Contact Info

Product

Resources

About