Enhanced detection of obfuscated HTTPS tunnel traffic using heterogeneous information network

HTTPS tunnel-based VPN services are increasingly used for malicious activities, such as remote control and data exfiltration. As detection mechanisms improve, some adversaries employ obfuscation techniques to evade detection. However, existing research mainly focuses on identifying HTTPS tunnel traffic and lacks specific studies on obfuscated traffic. In this paper, we propose HINT, a novel method that transforms HTTPS tunnel traffic detection into a graph node classification problem. Specifically, we construct a heterogeneous information graph to model the connections between clients and the VPN services. To enrich the graph’s semantics, we incorporate distinctive characteristics that are challenging to disguise and encapsulate them into specialized fingerprint nodes. Then we apply a hierarchical attention mechanism to automatically discern the significance of different nodes. Experimental results and extended analysis reveal that by integrating host topology, service statistics, and client traffic features, HINT maintains robust classification power when traffic shaping and padding techniques are employed. It is particularly effective without relying on packet sequences or payload information and maintains high detection capability even with added network noise.