你（不）属于这里：使用上下文学习检测DPI规避攻击
You Do (Not) Belong Here: Detecting DPI Evasion Attacks with Context Learning
摘要：
随着深度包检测（DPI）中间盒变得越来越流行，出现了一系列以规避这种中间盒为目标的对抗攻击。这些攻击中的许多攻击利用中间盒网络协议实现与在终端主机上实现的更严格/完整版本之间的差异。这些规避攻击主要涉及对数据包的微妙操作，以在DPI和终端主机上引起不同的行为，从而掩盖恶意网络流量，否则可以检测到。随着最近的自动化发现，手动策划用于检测这些操纵的规则已经变得非常具有挑战性。在这项工作中，我们提出了CLAP，这是第一个完全自动化的无监督ML解决方案，可以准确检测和定位DPI规避攻击。通过学习我们所谓的数据包上下文，它基本上捕获了（1）连接中不同数据包之间的相互关系;（2）每个数据包中的不同报头字段，仅从良性流量跟踪中，CLAP可以检测和查明违反良性数据包上下文的数据包（这些数据包是为逃避目的而专门制作的）。我们的评估与73个国家的最先进的DPI规避攻击表明，CLAP实现了0.963的接收器工作特征曲线下的面积（AUC-ROC），一个相等的出错率（EER）只有0.061的检测，和94.6%的定位准确率。这些结果表明，CLAP可以是一个很有前途的工具，挫败DPI逃避攻击。
英文摘要：
As Deep Packet Inspection (DPI) middleboxes become increasingly popular, a spectrum of adversarial attacks have emerged with the goal of evading such middleboxes. Many of these attacks exploit discrepancies between the middlebox network protocol implementations, and the more rigorous/complete versions implemented at end hosts. These evasion attacks largely involve subtle manipulations of packets to cause different behaviours at DPI and end hosts, to cloak malicious network traffic that is otherwise detectable. With recent automated discovery, it has become prohibitively challenging to manually curate rules for detecting these manipulations. In this work, we propose CLAP, the first fully-automated, unsupervised ML solution to accurately detect and localize DPI evasion attacks. By learning what we call the packet context, which essentially captures inter-relationships across both (1) different packets in a connection; and (2) different header fields within each packet, from benign traffic traces only, CLAP can detect and pinpoint packets that violate the benign packet contexts (which are the ones that are specially crafted for evasion purposes). Our evaluations with 73 state-of-the-art DPI evasion attacks show that CLAP achieves an Area Under the Receiver Operating Characteristic Curve (AUC-ROC) of 0.963, an Equal Error Rate (EER) of only 0.061 in detection, and an accuracy of 94.6% in localization. These results suggest that CLAP can be a promising tool for thwarting DPI evasion attacks.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
