A Method of Shadowsocks(R) Traffic Identification Based on Protocol Analysis

Shadowsocks (R) is a proxy software based on Socks5, which is the collective name of Shadowsocks and Shadowsocks (R). In order to improves the shortcomings of other softwares breaking internet censorship, Shadowsocks (R) is a private protocol without handshake negotiation mechanism, and pays more attention to high camouflage and high concealment of traffic, which makes it difficult to use common methods(fingerprint identification, port filtering)to identify Shadowsocks (R) traffic[1], This paper proposes a method of Shadowsocks (R) traffic identification from the perspective of the protocol, which extracts features from four dimensions, and inputs features into the machine learning model for training. This method performs secondary identification and statistical filtering on the output of the machine learning model, and finally identifys Shadowsocks (R) traffic. This method has been very well validated in the laboratory environment.