An Uncertainty-Based Traffic Training Approach to Efficiently Identifying Encrypted Proxies

Encrypted proxies, such as Shadowsocks and v2ray, are increasingly used to reserve user privacy and circumvent censorship. However, they are also widely misused by attackers to carry out illegal activities like malware downloading, information theft. Therefore, identifying encrypted proxies is a fundamental task concerning cyber security for network administrators. Existing studies focus on traffic feature engineering and designing the classification model. Although indispensable, they do not consider the training efficiency problem, thereby unable to approach the best possible performance when the number of affordable training samples is limited due to resource constraint. In this paper, we propose an uncertainty-based traffic sample selection strategy to boost traffic training of encrypted proxies. The proposed strategy allows one to use fewer samples to quickly learn diverse traffic characteristics. Through experiments, we demonstrate that our strategy significantly outperforms random sample selection, and hence substantially improves identification performance.