Robust Technique for Detecting and Blocking of VPN over Networks

In computer networks, data and information may be exchanged between linked devices through network communication. Networks are the backbone of the digital world, allowing data to be sent between computers, servers, and other devices. Standards and protocols like HTTP (Hypertext Transfer Protocol), which provide the guidelines for data interchange control this communication. The effectiveness and dependability of network communication, whether via wired or wireless connections, directly influences file sharing, real-time collaboration, and internet surfing. Organizations heavily rely on firewalls to safeguard internal networks from external threats. These firewalls enforce access rules, filter content, and scan for intrusions, providing robust protection. Virtual Private Networks (VPN) mask their real traffic under SSL (Secure Sockets Layer)/TLS (Transport Layer Security). Detecting such VPN services requires the use of firewalls that can analyze SSL/TLS actively. These features aren't cost-efficient and may not be suitable for every organization. VPN services may be used by users to bypass organizational compliance for accessing geo-restricted platforms, personal browsing, and connecting to personal network infrastructures that may be deemed off-limits within an organization. This usage poses a significant risk. The anonymity VPN services offer may influence users to engage in restricted content, and visit malicious sites, thereby posing a threat of inviting malware. Furthermore, these actions may expose the organization to legal consequences. Organizations may want to block the usage of VPN services to avoid sensitive information being exfiltrated, server compromization, and network jeopardization. In this paper, we have proposed an effective approach to detect VPN activity and block the user from accessing VPN services. Packet Sniffing is a process through which source IP addresses and destination IP addresses can be determined, and the source IP address and the destination IP address are analyzed by checking in with known VPN server IP ranges, to identify patterns of VPN usage. By analyzing the pattern, the program can raise a flag for VPN activity.