Research on ShadowsocksR Traffic Identification Based on DART Algorithm

Shadowsocks (SS) is a new popular anonymous communication software in recent years. The traffic generated by SS is very difficult to identify. There is also an enhanced version of SS, called ShadowsocksR(SSR), which can disguise SS traffic as traditional protocol traffic, such as HTTP traffic, TLS traffic, etc. This makes the identification of SS traffic more difficult. In reference [16], an identification method of HTTP camouflaging traffic of SS is proposed for the first time. Here, a new identification method is proposed based on dart algorithm. Compared with reference [16], this method has more types and wider range of SSR obfuscated traffic, and has better identification effect for recent SSR obfuscated traffic, with the accuracy, the recall and the precision are all above 98.5%.