TMorph: A Traffic Morphing Framework to Test Network Defenses Against Adversarial Attacks

The increase in the Internet connectivity and the adoption of network-based services has resulted in unprecedented traffic volume. This increase results in new challenges for traffic classification in various areas including network traffic shaping, malicious traffic detection, and censoring illegitimate content. Traffic classification solutions are subject to evasion attacks from adversaries. Researchers and vendors need to assess how their systems behave against evasion attacks in this arms race. In this paper, we propose TMorph—an open source traffic morphing framework that efficiently simulates adversarial attacks and generates datasets for research and testing purposes. TMorph provides: broad support of network traffic morphing; ease of use for ordinary users to generate attack traffic with minimum commands or lines of code; and flexibility and extensibility so users can extend our framework easily to support more protocols and features. We present three case studies of utilizing TMorph to create encrypted malware traffic, apply encoding and obfuscation operations, and create tunnels for traffic effortlessly. We conduct performance measurements to show that TMorph can perform these operations with low CPU runtime and memory footprint. With evasion attacks on the rise, TMorph can assist researchers and vendors to build resilient network defenses.