Namgeon Kim, Seo-Hyeon Kim, Sanghoon Jeon, Journal of Internet Computing and Services, Vol. 26, No. 2, pp. 1-10, Apr. 2025
10.7472/jksii.2025.26.2.1, Full Text:  HTML
Keywords: VPN, NoN-VPN, Network Traffic Classification, Machine Learning Models, Feature Importance Analysis

Abstract

With the expansion of remote work following the COVID-19 pandemic, the use of Virtual Private Networks (VPNs) has increased, leading to heightened security threats. While VPNs provide a secure network environment, cybercriminals can exploit them to conceal illegal activities, necessitating effective classification techniques to distinguish between VPN and Non-VPN traffic. However, since VPN traffic is transmitted in an encrypted format, traditional packet inspection methods face limitations in detection. This study uses the ISCXVPN2016 dataset to develop a tree-based machine learning model for VPN detection, leveraging flow-based network traffic data. We develop a Decision Tree, XGBoost, Random Forest, and Gradient Boosting models to compare VPN and Non-VPN traffic classification performance, conducting experiments within the Orange3 environment. The experimental results demonstrate that the XGBoost model achieved the highest classification accuracy, particularly excelling with 15-second flow duration-based data. Additionally, feature importance analysis was performed to identify key factors influencing the performance of the trained model, alongside statistical analysis to extract meaningful characteristics. We confirmed that 10 key features significantly impact VPN detection performance, including FlowBytesPerSecond (bandwidth usage) and FlowIAT (inter-packet time intervals). These findings validate the effectiveness of machine learning-based VPN detection models and suggest their potential applicability in real-time network security and Intrusion Detection Systems (IDS).

Statistics
Cite this article