TY -的AU - Zain ul Abideen,默罕默德盟,萨利姆,沙赫扎德盟-埃贾兹·,正在Madiha PY - 2019 DA - 2019/10/29 TI - VPN流量检测在ssl保护的通道SP - 7924690六世- 2019 AB -近年来,安全通信协议在网络比如HTTPS(超文本传输协议)被广泛使用,而不是普通的web通信协议,比如HTTP(超文本传输协议)。HTTPS提供端到端加密用户和服务之间。如今,组织使用网络防火墙和入侵检测和预防系统(idp)分析网络流量检测和防止攻击和漏洞。根据组织的规模,这些设备可能有不同的功能。简单的网络入侵检测系统(NIDS)和防火墙通常没有功能检查HTTPS或加密流量,所以他们依赖于加密流量管理网络的加密的有效载荷。最近的和强大的下一代防火墙安全套接字层(SSL)检查功能,是昂贵的,可能不适合每一个组织。虚拟专用网(VPN)是一个隐藏了真实的交通服务用户和服务器之间通过创建ssl保护的通道。每一个互联网活动然后建立SSL隧道下执行。网络内的用户恶意或隐藏他的活动从网络安全管理组织可以使用VPN服务。用户可以使用任何VPN服务绕过过滤器或签名应用于网络安全设备。 These services may be the source of new virus or worm injected inside the network or a gateway to facilitate information leakage. In this paper, we have proposed a novel approach to detect VPN activity inside the network. The proposed system analyzes the communication between user and the server to analyze and extract features from network, transport, and application layer which are not encrypted and classify the incoming traffic as malicious, i.e., VPN traffic or standard traffic. Network traffic is analyzed and classified using DNS (Domain Name System) packets and HTTPS- (Hypertext Transfer Protocol Secure-) based traffic. Once traffic is classified, the connection based on the server’s IP, TCP port connected, domain name, and server name inside the HTTPS connection is analyzed. This helps in verifying legitimate connection and flags the VPN-based traffic. We worked on top five freely available VPN services and analyzed their traffic patterns; the results show successful detection of the VPN activity performed by the user. We analyzed the activity of five users, using some sort of VPN service in their Internet activity, inside the network. Out of total 729 connections made by different users, 329 connections were classified as legitimate activity, marking 400 remaining connections as VPN-based connections. The proposed system is lightweight enough to keep minimal overhead, both in network and resource utilization and requires no specialized hardware. SN - 1939-0114 UR - https://doi.org/10.1155/2019/7924690 DO - 10.1155/2019/7924690 JF - Security and Communication Networks PB - Hindawi KW - ER -