A Generalization-Enhanced Method for Encrypted Proxy Traffic Identification Based on Autoencoder

While encrypted proxy services like Shadowsocks and Vmess safeguard user privacy by encrypting traffic data, they also provide anonymity tools for cybercriminals, increasing the difficulty of regulating and combating activities such as online fraud and cyberattacks. This presents significant challenges for network management, as these services can obfuscate and disguise traffic with continually updated tools, leading to dynamic traffic features that traditional detection methods struggle to identify. However, the feature engineering and model designing of existing methods is based on previously commonly used encrypted proxy traffic and cannot cope with new types, which means that existing methods are poor in generalization ability. To overcome these challenges, this paper introduces a novel method for identifying encrypted proxy traffic. Initially, by analyzing encrypted proxy traffic, we extract features related to the information entropy, TLS protocol, and length of traffic packets. In this way, we obtain a comprehensive feature vector of length 325. Second, we propose a new identification model, called BiAE-MLP, consisting of an encoding layer with two autoencoders and a classification layer with a MLP classifier. We evaluate our method with four experiments. As a result, our method achieves a 98% F1-score on a test dataset with the same distribution as the training dataset and a 91% F1-score on a dataset with a different distribution. It indicates the effectiveness and generalization ability of our method. Additionally, in Experiment 4, we demonstrate that the encoding layer of the BiAE-MLP plays a crucial role in enhancing the model's generalization ability.