A multi‐granularity heuristic‐combining approach for censorship circumvention activity identification. Issue 16 (4th July 2016)

• Record Type: Journal Article
• Authors: Zhuo, Zhongliu; Zhang, Xiaosong; Li, Ruixing; Chen, Ting; Zhang, Jingzhong
• Is Part Of: Security and communication networks. Volume 9:Issue 16(2016)
• Page Start: 3178
• Page End: 3189
• Publication Date: 2016-07-04
• Subjects: multi‐granularity -- heuristic‐combining -- feature extraction -- censorship circumvention; Computer networks -- Security measures -- Periodicals; Computer security -- Periodicals; Cryptography -- Periodicals; 005.805
• DOI: 10.1002/sec.1524
• Languages: English
• ISSNs: 1939-0114

Abstract

Abstract: Identifying censorship circumvention network traffic has become an important task for preventing abuse of those tools. However, traditional flow‐based methods have drawbacks in high false positive rate, and they fail to exploit useful hidden features. In this paper, we propose a novel feature extraction method for censorship circumvention activity identification, which extracts features from multi‐granularity, and it uses a heuristic‐combining approach to make the final decision. Moreover, unlike traditional approaches, which classify on an individual flow or a packet, the proposed method examines on a new granularity. We present an implementation based on the proposed method, and the results are presented to demonstrate the effectiveness of our method. In comparison to the traditional flow‐based methods, the proposed strategy has a slightly lower overall accuracy rate than flow‐based approaches; however, its average false positive rate is significantly lower than the traditional method. Copyright © 2016 John Wiley & Sons, Ltd. Abstract : We propose a novel multi‐granularity method to extract features that later feed into a heuristic learning algorithm, which overcomes the single granularity limitation of traditional methods. Our method uses a heuristic‐combining approach to coordinate the features returned from multi‐granularity feature extraction procedure. An implementation is realized, and the verification of the proposed method is carried out in a real lab network environment, which demonstrates the effectiveness of our approach.