ProxyKiller: An Anonymous Proxy Traffic Attack Model Based on Traffic Behavior Graphs

As common tools for evading censorship and protecting privacy, anonymous proxies are widely favored for their lightweight and easy deployment. In recent years, anonymous proxies have continually evolved regarding traffic obfuscation and masking strategies. Due to the lack of design targeting the connection behavior features of different proxy flows, current methods for proxy traffic identification often suffer from high false positive rates. Consequently, these methods are insufficient for real-world applications. This masks the deficiencies of existing anonymous proxy technologies in combating detection models based on flow relationship analysis. To address the issues mentioned, we introduce a novel proxy traffic attack model called ProxyKiller based on multi-flow connection behavior features. After obtaining the original PCAP traffic files, ProxyKiller constructs traffic behavior graphs using extracted temporal, spatial, content, and specially designed byte features. Subsequently, ProxyKiller extracts latent topological structure features through graph neural networks, integrates them into a unified graph-level representation vector, and obtains prediction results for each traffic behavior graph through a random forest model. Finally, ProxyKiller implements a global decision-making mechanism from a traffic graph correlation perspective to correct prediction results for related traffic behavior graphs. Experimental results on three real-world datasets demonstrate that ProxyKiller outperforms several state-of-the-art traffic classification methods and shows robustness in various proxy traffic classification tasks. These results indicate that current anonymous proxies exhibit certain vulnerabilities when countering traffic analysis methods based on traffic behavior graph structure.