{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,4]],"date-time":"2026-02-04T17:14:21Z","timestamp":1770225261090,"version":"3.49.0"},"reference-count":37,"publisher":"Springer Science and Business Media LLC","issue":"3","license":[{"start":{"date-parts":[[2020,4,8]],"date-time":"2020-04-08T00:00:00Z","timestamp":1586304000000},"content-version":"tdm","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"},{"start":{"date-parts":[[2020,4,8]],"date-time":"2020-04-08T00:00:00Z","timestamp":1586304000000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"funder":[{"DOI":"10.13039\/501100011151","name":"Key Laboratory of Computer Network and Information Integration","doi-asserted-by":"crossref","award":["C19601"],"award-info":[{"award-number":["C19601"]}],"id":[{"id":"10.13039\/501100011151","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["J Comput Virol Hack Tech"],"published-print":{"date-parts":[[2020,9]]},"DOI":"10.1007\/s11416-020-00353-z","type":"journal-article","created":{"date-parts":[[2020,4,8]],"date-time":"2020-04-08T12:04:38Z","timestamp":1586347478000},"page":"217-227","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":10,"title":["ACER: detecting Shadowsocks server based on active probe technology"],"prefix":"10.1007","volume":"16","author":[{"given":"Jiaxing","family":"Cheng","sequence":"first","affiliation":[]},{"given":"Ying","family":"Li","sequence":"additional","affiliation":[]},{"given":"Cheng","family":"Huang","sequence":"additional","affiliation":[]},{"given":"Ailing","family":"Yu","sequence":"additional","affiliation":[]},{"given":"Tao","family":"Zhang","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2020,4,8]]},"reference":[{"key":"353_CR1","doi-asserted-by":"crossref","unstructured":"Lu, Z., Li, Z., Yang, J., Xu, T., Zhai, E., Liu, Y., Wilson, C.: Accessing google scholar under extreme internet censorship: a legal avenue. In: Proceedings of the 18th ACM\/IFIP\/USENIX Middleware Conference: Industrial Track, pp. 8\u201314 (2017)","DOI":"10.1145\/3154448.3154450"},{"issue":"6","key":"353_CR2","doi-asserted-by":"publisher","first-page":"43","DOI":"10.1109\/MSP.2016.121","volume":"14","author":"L Dixon","year":"2016","unstructured":"Dixon, L., Ristenpart, T., Shrimpton, T.: Network traffic obfuscation and automated internet censorship. IEEE Secur. Privacy 14(6), 43\u201353 (2016)","journal-title":"IEEE Secur. Privacy"},{"key":"353_CR3","doi-asserted-by":"crossref","unstructured":"Pannu, M., Gill, B., Bird, R., Yang, K., Farrel, B.: Exploring proxy detection methodology. In: IEEE International Conference on Cybercrime and Computer Forensic (ICCCF), pp. 1\u20136. IEEE (2016)","DOI":"10.1109\/ICCCF.2016.7740438"},{"key":"353_CR4","doi-asserted-by":"crossref","unstructured":"Deng, Z., Liu, Z., Chen, Z., Guo, Y.: The random forest based detection of shadowsock\u2019s traffic. In: 9th International Conference on Intelligent Human\u2013Machine Systems and Cybernetics (IHMSC), vol. 2, pp. 75\u201378. IEEE (2017)","DOI":"10.1109\/IHMSC.2017.132"},{"key":"353_CR5","doi-asserted-by":"publisher","first-page":"41017","DOI":"10.1109\/ACCESS.2019.2907149","volume":"7","author":"X Zeng","year":"2019","unstructured":"Zeng, X., Chen, X., Shao, G., He, T., Han, Z., Wen, Y., Wang, Q.: Flow context and host behavior based Shadowsocks\u2019s traffic identification. IEEE Access 7, 41017\u201341032 (2019)","journal-title":"IEEE Access"},{"key":"353_CR6","volume-title":"The Handbook of Brain Theory and Neural Networks","author":"S Amari","year":"2003","unstructured":"Amari, S., et al.: The Handbook of Brain Theory and Neural Networks. MIT Press, Cambridge (2003)"},{"key":"353_CR7","unstructured":"Lewis, R.J: An introduction to classification and regression tree (cart) analysis. In: Annual Meeting of the Society for Academic Emergency Medicine in San Francisco, CA, vol. 14 (2000)"},{"issue":"3","key":"353_CR8","first-page":"18","volume":"2","author":"A Liaw","year":"2002","unstructured":"Liaw, A., Wiener, M., et al.: Classification and regression by randomforest. R News 2(3), 18\u201322 (2002)","journal-title":"R News"},{"key":"353_CR9","doi-asserted-by":"crossref","unstructured":"Dingledine, R., Mathewson, N., Syverson, P.: Tor: the second-generation onion router. Technical report. Naval Research Lab, Washington DC (2004)","DOI":"10.21236\/ADA465464"},{"key":"353_CR10","doi-asserted-by":"crossref","unstructured":"Hodo, E., Bellekens, X., Iorkyase, E., Hamilton, A., Tachtatzis, C., Atkinson, R.: Machine learning approach for detection of nontor traffic. In: Proceedings of the 12th International Conference on Availability, Reliability and Security, pp. 1\u20136 (2017)","DOI":"10.1145\/3098954.3106068"},{"key":"353_CR11","doi-asserted-by":"crossref","unstructured":"He, G., Yang, M., Gu, X., Luo, J., Ma, Y.: A novel active website fingerprinting attack against tor anonymous system. In: Proceedings of the 2014 IEEE 18th International Conference on Computer Supported Cooperative Work in Design (CSCWD), pp. 112\u2013117. IEEE (2014)","DOI":"10.1109\/CSCWD.2014.6846826"},{"key":"353_CR12","unstructured":"Lashkari, A., Habibi, D.-G., Gerard, M., Mohammad S.I., Ghorbani, A.A: Characterization of tor traffic using time based features. In: ICISSP, pp. 253\u2013262 (2017)"},{"key":"353_CR13","doi-asserted-by":"crossref","unstructured":"Wright, J., Darer, A., Farnan, O.: On identifying anomalies in tor usage with applications in detecting internet censorship. In: Proceedings of the 10th ACM Conference on Web Science, pp. 87\u201396 (2018)","DOI":"10.1145\/3201064.3201093"},{"key":"353_CR14","unstructured":"Seid, H.A., Lespagnol, A.: Virtual private network. US Patent 5,768,271 (1998)"},{"issue":"2","key":"353_CR15","doi-asserted-by":"publisher","first-page":"108","DOI":"10.1080\/23742917.2017.1321891","volume":"1","author":"S Bagui","year":"2017","unstructured":"Bagui, S., Fang, X., Kalaimannan, E., Bagui, S.C., Sheehan, J.: Comparison of machine-learning algorithms for classification of VPN network traffic flow using time-related features. J. Cyber Secur. Technol. 1(2), 108\u2013126 (2017)","journal-title":"J. Cyber Secur. Technol."},{"key":"353_CR16","volume-title":"Logistic Regression","author":"DG Kleinbaum","year":"2002","unstructured":"Kleinbaum, D.G., Dietz, K., Gail, M., Klein, M., Klein, M.: Logistic Regression. Springer, New York (2002)"},{"key":"353_CR17","doi-asserted-by":"crossref","DOI":"10.7551\/mitpress\/4175.001.0001","volume-title":"Learning with Kernels: Support Vector Machines, Regularization, Optimization, and Beyond","author":"B Scholkopf","year":"2001","unstructured":"Scholkopf, B., Smola, A.J.: Learning with Kernels: Support Vector Machines, Regularization, Optimization, and Beyond. MIT Press, Cambridge (2001)"},{"key":"353_CR18","first-page":"60","volume":"18","author":"P Murphy Kevin","year":"2006","unstructured":"Murphy Kevin, P., et al.: Naive bayes classifiers. Univ. B.C. 18, 60 (2006)","journal-title":"Univ. B.C."},{"issue":"2","key":"353_CR19","doi-asserted-by":"publisher","first-page":"1883","DOI":"10.4249\/scholarpedia.1883","volume":"4","author":"LE Peterson","year":"2009","unstructured":"Peterson, L.E.: K-nearest neighbor. Scholarpedia 4(2), 1883 (2009)","journal-title":"Scholarpedia"},{"key":"353_CR20","doi-asserted-by":"crossref","unstructured":"Dietterich, T.G: Ensemble methods in machine learning. In: International Workshop on Multiple Classifier Systems, pp. 1\u201315. Springer (2000)","DOI":"10.1007\/3-540-45014-9_1"},{"key":"353_CR21","doi-asserted-by":"crossref","unstructured":"Draper-Gil, G., Lashkari, A.H., Mamun, M.S.I., Ghorbani, A.A: Characterization of encrypted and vpn traffic using time-related. In Proceedings of the 2nd International Conference on Information Systems Security and Privacy (ICISSP), pp. 407\u2013414 (2016)","DOI":"10.5220\/0005740704070414"},{"key":"353_CR22","unstructured":"Dreger, H., Feldmann, A., Mai, M., Paxson, V., Sommer, R.: Dynamic application-layer protocol analysis for network intrusion detection. In: 15th USENIX Security Symposium, pp. 257\u2013272. USENIX Association (2006)"},{"key":"353_CR23","doi-asserted-by":"crossref","unstructured":"Moore, A.W., Papagiannaki, K.: Toward the accurate identification of network applications. In: International Workshop on Passive and Active Network Measurement, pp. 41\u201354. Springer (2005)","DOI":"10.1007\/978-3-540-31966-5_4"},{"issue":"5","key":"353_CR24","doi-asserted-by":"publisher","first-page":"76","DOI":"10.1109\/MCOM.2019.1800819","volume":"57","author":"S Rezaei","year":"2019","unstructured":"Rezaei, S., Liu, X.: Deep learning for encrypted traffic classification: an overview. IEEE Commun. Mag. 57(5), 76\u201381 (2019)","journal-title":"IEEE Commun. Mag."},{"key":"353_CR25","doi-asserted-by":"crossref","unstructured":"Kim, H., Claffy, K.C., Fomenkov, M., Barman, D., Faloutsos, M., Lee, K..: Internet traffic classification demystified: myths, caveats, and the best practices. In: Proceedings of the 2008 ACM CoNEXT Conference, pp. 1\u201312 (2008)","DOI":"10.1145\/1544012.1544023"},{"issue":"3","key":"353_CR26","doi-asserted-by":"publisher","first-page":"1999","DOI":"10.1007\/s00500-019-04030-2","volume":"24","author":"M Lotfollahi","year":"2020","unstructured":"Lotfollahi, M., Siavoshani, M.J., Zade, R.S.H., Saberian, M.: Deep packet: a novel approach for encrypted traffic classification using deep learning. Soft. Comput. 24(3), 1999\u20132012 (2020)","journal-title":"Soft. Comput."},{"key":"353_CR27","doi-asserted-by":"crossref","unstructured":"Anderson, B., McGrew, D.: Identifying encrypted malware traffic with contextual flow data. In: Proceedings of the 2016 ACM Workshop on Artificial Intelligence and Security, pp. 35\u201346 (2016)","DOI":"10.1145\/2996758.2996768"},{"key":"353_CR28","doi-asserted-by":"crossref","unstructured":"Torroledo, I., Camacho, L.D., Bahnsen, A.C.: Hunting malicious TLS certificates with deep neural networks. In Proceedings of the 11th ACM Workshop on Artificial Intelligence and Security, pp. 64\u201373 (2018)","DOI":"10.1145\/3270101.3270105"},{"key":"353_CR29","unstructured":"M\u00fcnz, G., Li, S., Carle, G.: Traffic anomaly detection using k-means clustering. In: GI\/ITG Workshop MMBnet, pp. 13\u201314 (2007)"},{"key":"353_CR30","doi-asserted-by":"crossref","unstructured":"Chou, L.D., Tseng, C.-W., Lai, M.-S., Chen, W.-Y., Chen, K.-C., Yen, C.-K., Ou, T.-F., Tsai, W.-H., Chiu, Y.-H.: Classification of malicious traffic using tensorflow machine learning. In: 2018 International Conference on Information and Communication Technology Convergence (ICTC), pp. 186\u2013190. IEEE (2018)","DOI":"10.1109\/ICTC.2018.8539685"},{"key":"353_CR31","unstructured":"Michael, A.K.J., Valla, E., Neggatu, N.S., Moore, A.W: Network traffic classification via neural networks. Technical report. University of Cambridge, Computer Laboratory (2017)"},{"key":"353_CR32","doi-asserted-by":"crossref","unstructured":"Li, R., Xiao, X., Ni, S., Zheng, H., Xia, S.: Byte segment neural network for network traffic classification. In: 2018 IEEE\/ACM 26th International Symposium on Quality of Service (IWQoS), pp. 1\u201310. IEEE (2018)","DOI":"10.1109\/IWQoS.2018.8624128"},{"key":"353_CR33","doi-asserted-by":"crossref","unstructured":"Zheng, Z., Reddy, A.N.: Safeguarding building automation networks: the-driven anomaly detector based on traffic analysis. In: 26th International Conference on Computer Communication and Networks (ICCCN), pp. 1\u201311. IEEE (2017)","DOI":"10.1109\/ICCCN.2017.8038393"},{"key":"353_CR34","unstructured":"Winter, P., Lindskog, S.: How the great firewall of china is blocking tor. USENIX-The Advanced Computing Systems Association (2012)"},{"key":"353_CR35","doi-asserted-by":"crossref","unstructured":"Friedman, J.H.: Greedy function approximation: a gradient boosting machine. Ann. Stat. 1189\u20131232 (2001)","DOI":"10.1214\/aos\/1013203451"},{"key":"353_CR36","doi-asserted-by":"crossref","unstructured":"DeLong, E.R., DeLong, D.M., Clarke-Pearson, D.L: Comparing the areas under two or more correlated receiver operating characteristic curves: a nonparametric approach. Biometrics 837\u2013845 (1988)","DOI":"10.2307\/2531595"},{"key":"353_CR37","doi-asserted-by":"publisher","DOI":"10.1017\/CBO9780511801389","volume-title":"An Introduction to Support Vector Machines and Other Kernel-Based Learning Methods","author":"N Cristianini","year":"2000","unstructured":"Cristianini, N., Shawe-Taylor, J., et al.: An Introduction to Support Vector Machines and Other Kernel-Based Learning Methods. Cambridge University Press, Cambridge (2000)"}],"container-title":["Journal of Computer Virology and Hacking Techniques"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/s11416-020-00353-z.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/article\/10.1007\/s11416-020-00353-z\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/s11416-020-00353-z.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,8,3]],"date-time":"2024-08-03T17:30:55Z","timestamp":1722706255000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/s11416-020-00353-z"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,4,8]]},"references-count":37,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2020,9]]}},"alternative-id":["353"],"URL":"https:\/\/doi.org\/10.1007\/s11416-020-00353-z","relation":{},"ISSN":["2263-8733"],"issn-type":[{"value":"2263-8733","type":"electronic"}],"subject":[],"published":{"date-parts":[[2020,4,8]]},"assertion":[{"value":"26 August 2019","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"2 March 2020","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"8 April 2020","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}}]}}