{"id":11200,"date":"2024-10-30T19:48:19","date_gmt":"2024-10-30T16:48:19","guid":{"rendered":"https:\/\/vasexperts.com\/?p=11200"},"modified":"2025-08-11T14:13:31","modified_gmt":"2025-08-11T11:13:31","slug":"from-classical-methods-to-neural-networks-exploring-the-potential-of-deep-learning-in-identifying-obfuscated-traffic","status":"publish","type":"post","link":"https:\/\/vasexperts.com\/fr\/blog\/telecom\/from-classical-methods-to-neural-networks-exploring-the-potential-of-deep-learning-in-identifying-obfuscated-traffic\/","title":{"rendered":"Des m\u00e9thodes classiques aux r\u00e9seaux neuronaux : Exploration du potentiel de l&rsquo;apprentissage profond dans l&rsquo;identification du trafic obscurci"},"content":{"rendered":"<h2>M\u00e9thodes traditionnelles pour l\u2019analyse du trafic r\u00e9seau<\/h2>\r\nLa classification du trafic r\u00e9seau \u00e0 l\u2019aide de m\u00e9thodes traditionnelles implique diff\u00e9rentes approches, chacune ayant ses propres forces et faiblesses. Examinons les principales m\u00e9thodes et leurs limites lorsqu\u2019il s\u2019agit de trafic obscurci et crypt\u00e9.\r\n<h3>1. La m\u00e9thode SNI (Server Name Indication)<\/h3>\r\nLa m\u00e9thode SNI repose sur l\u2019analyse des informations de domaine qu\u2019une connexion crypt\u00e9e transmet en clair lors de l\u2019\u00e9tablissement d\u2019une session TLS. \u00c9tant donn\u00e9 que le nom de domaine est sp\u00e9cifi\u00e9 dans l\u2019en-t\u00eate \u00ab\u00a0Server Name\u00a0\u00bb au cours de la poign\u00e9e de main TLS, cette m\u00e9thode permet d\u2019identifier les serveurs et les services m\u00eame si le trafic ult\u00e9rieur est crypt\u00e9.\r\n\r\n   <strong>  Limites de la m\u00e9thode SNI :   <\/strong>  \r\n<ul>\r\n \t<li>   <strong>  Pr\u00e9cision insuffisante avec l\u2019obscurcissement des ports et la traduction des adresses :    <\/strong>   Lorsque les adresses IP et les ports sont modifi\u00e9s ou obscurcis, la pr\u00e9cision diminue car le lien entre le SNI et une application sp\u00e9cifique peut \u00eatre perturb\u00e9.<\/li>\r\n \t<li>   <strong>  Impossibilit\u00e9 d\u2019identification lors de l\u2019utilisation de VPN :    <\/strong>  L\u2019en-t\u00eate SNI devient indisponible pour l\u2019analyse si le trafic passe par un VPN, car il est cach\u00e9 par le cryptage du tunnel.<\/li>\r\n \t<li>   <strong>  Manque de donn\u00e9es pour tous les protocoles :    <\/strong>  Tous les protocoles et applications ne transmettent pas de donn\u00e9es via TLS, ce qui rend l\u2019analyse bas\u00e9e sur SNI inapplicable \u00e0 ces protocoles.<\/li>\r\n<\/ul>\r\n<h3>2. Inspection de la charge utile<\/h3>\r\nL\u2019inspection des donn\u00e9es utiles implique une analyse d\u00e9taill\u00e9e du contenu des paquets afin d\u2019identifier les mod\u00e8les et les caract\u00e9ristiques propres \u00e0 un protocole ou \u00e0 une application. Cette m\u00e9thode permet de d\u00e9terminer avec une grande pr\u00e9cision les types de donn\u00e9es et de les classer en fonction de leur contenu.\r\n\r\n   <strong>  Limitations of Payload Inspection :   <\/strong>  \r\n<ul>\r\n \t<li>   <strong>  Co\u00fbts des ressources informatiques :   <\/strong>   L\u2019inspection des charges utiles n\u00e9cessite des ressources importantes en raison de la n\u00e9cessit\u00e9 d\u2019examiner le contenu de chaque paquet.<\/li>\r\n \t<li>   <strong>  Probl\u00e8mes de confidentialit\u00e9 :   <\/strong>   L\u2019acc\u00e8s complet aux donn\u00e9es des paquets soul\u00e8ve des probl\u00e8mes de confidentialit\u00e9, en particulier lorsque l\u2019on travaille avec des donn\u00e9es personnelles ou d\u2019entreprise.<\/li>\r\n \t<li>   <strong>  Impossibilit\u00e9 d\u2019analyser le trafic crypt\u00e9 :   <\/strong>   Le chiffrement du trafic (TLS ou VPN) rend l\u2019inspection des charges utiles impossible, ce qui r\u00e9duit l\u2019efficacit\u00e9 de cette m\u00e9thode dans les environnements modernes o\u00f9 une part importante du trafic est chiffr\u00e9e.<\/li>\r\n<\/ul>\r\n<h3>3. M\u00e9thodes d\u2019apprentissage automatique statistique<\/h3>\r\nLes m\u00e9thodes d\u2019apprentissage automatique statistique classent le trafic en fonction de diverses m\u00e9triques et caract\u00e9ristiques (telles que la taille des paquets, la fr\u00e9quence et les intervalles de temps). Les mod\u00e8les peuvent \u00eatre form\u00e9s sur des donn\u00e9es statistiques, ce qui permet d\u2019identifier efficacement certains types de trafic dans certains cas.\r\n\r\n   <strong>  Limites des m\u00e9thodes statistiques d\u2019apprentissage automatique :   <\/strong>  \r\n<ul>\r\n \t<li>   <strong>  N\u00e9cessit\u00e9 de donn\u00e9es propres et \u00e9tiquet\u00e9es :   <\/strong>   Pour fonctionner correctement, les mod\u00e8les d\u2019apprentissage statistique n\u00e9cessitent des donn\u00e9es \u00e9tiquet\u00e9es de haute qualit\u00e9, qu\u2019il est difficile de collecter, en particulier pour les protocoles les moins courants.<\/li>\r\n \t<li>   <strong>  Forte intensit\u00e9 de ressources :   <\/strong>   Cette m\u00e9thode n\u00e9cessite d\u2019importantes ressources informatiques, ce qui ralentit l\u2019analyse en cas de volumes de donn\u00e9es importants.<\/li>\r\n \t<li>   <strong>  Faible efficacit\u00e9 en pr\u00e9sence d\u2019obscurcissement du trafic :   <\/strong>   Les protocoles qui masquent leurs m\u00e9tadonn\u00e9es ou modifient continuellement les sch\u00e9mas de trafic peuvent compliquer l\u2019analyse, ce qui entra\u00eene une faible pr\u00e9cision des mod\u00e8les statistiques.<\/li>\r\n<\/ul>\r\nPar cons\u00e9quent, bien que les m\u00e9thodes traditionnelles puissent pr\u00e9senter une grande pr\u00e9cision dans certains cas, elles sont confront\u00e9es \u00e0 de nombreuses limitations, ce qui rend difficile la classification des types de trafic modernes.\r\n\r\n<hr>\r\n\r\n<h2>Approche des r\u00e9seaux neuronaux pour l\u2019identification du trafic r\u00e9seau obscurci<\/h2>\r\nNotre recherche explore l\u2019apprentissage profond comme une alternative plus pr\u00e9cise et plus flexible aux m\u00e9thodes traditionnelles. Nous avons mis en \u0153uvre des mod\u00e8les bas\u00e9s sur les r\u00e9seaux neuronaux convolutifs (CNN) et l\u2019architecture ResNet, en les adaptant \u00e0 la classification de haute pr\u00e9cision du trafic VPN et proxy chiffr\u00e9.\r\n<h3>Donn\u00e9es<\/h3>\r\nUn ensemble de donn\u00e9es Netflow 10 (IPFIX) a \u00e9t\u00e9 utilis\u00e9 pour la classification du trafic, con\u00e7u pour normaliser la transmission des informations IP de l\u2019exportateur au collecteur, pris en charge par des fabricants tels que Cisco, Solera, VMware et Citrix. Les sp\u00e9cifications IPFIX sont fournies dans les RFC 7011-7015 et RFC 5103.\r\n<h3>Collecte des donn\u00e9es<\/h3>\r\nLes donn\u00e9es ont \u00e9t\u00e9 collect\u00e9es \u00e0 l\u2019aide d\u2019un appareil dot\u00e9 d\u2019un syst\u00e8me d\u2019inspection approfondie des paquets (DPI) connect\u00e9 \u00e0 d\u2019autres appareils g\u00e9n\u00e9rant du trafic via divers VPN. Cette approche a permis de capturer des IP et des ports uniques g\u00e9n\u00e9r\u00e9s par des VPN avec des affectations dynamiques sous restrictions, ce qui a donn\u00e9 lieu \u00e0 un riche \u00e9ventail de combinaisons d\u2019IP et de ports uniques pour l\u2019entra\u00eenement du mod\u00e8le de r\u00e9seau neuronal.\r\n\r\n[product id=\u00a0\u00bb 19\u2033 type=\u00a0\u00bbdark\u00a0\u00bb]\r\n\r\nLes donn\u00e9es collect\u00e9es comprenaient les param\u00e8tres suivants :\r\n<table>\r\n<thead>\r\n<tr>\r\n<th>Type de donn\u00e9es<\/th>\r\n<th>Description<\/th>\r\n<\/tr>\r\n<\/thead>\r\n<tbody>\r\n<tr>\r\n<td>   <strong>  octet_delta_count   <\/strong>  <\/td>\r\n<td>Compteur entrant de longueur N x 8 bits pour le nombre d\u2019octets associ\u00e9s au flux IP.<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>   <strong>  packet_delta_count   <\/strong>  <\/td>\r\n<td>Compteur de paquets entrants de longueur N x 8 bits pour le nombre de paquets associ\u00e9s au flux IP.<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>   <strong>  protocol_identifier   <\/strong>  <\/td>\r\n<td>Byte de protocole IP.<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>   <strong>  ip_class_of_service   <\/strong>  <\/td>\r\n<td>Classe ou service IP.<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>   <strong>  source_port   <\/strong>  <\/td>\r\n<td>Port de l\u2019exp\u00e9diteur.<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>   <strong>  source_ipv4   <\/strong>  <\/td>\r\n<td>IPv4 de l\u2019exp\u00e9diteur.<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>   <strong>  destination_port   <\/strong>  <\/td>\r\n<td>Port du destinataire.<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>   <strong>  destination_ipv4   <\/strong>  <\/td>\r\n<td>IPv4 du destinataire.<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>   <strong>  bgp_source_as_number   <\/strong>  <\/td>\r\n<td>Num\u00e9ro du syst\u00e8me autonome BGP source (N peut \u00eatre 2 ou 4).<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>   <strong>  bgp_destination_as_number   <\/strong>  <\/td>\r\n<td>Num\u00e9ro du syst\u00e8me autonome BGP destination (N peut \u00eatre 2 ou 4).<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>   <strong>  input_snmp   <\/strong>  <\/td>\r\n<td>Identifiant de r\u00e9seau virtuel associ\u00e9 \u00e0 l\u2019interface entrante.<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>   <strong>  output_snmp   <\/strong>  <\/td>\r\n<td>Identifiant de r\u00e9seau virtuel associ\u00e9 \u00e0 l\u2019interface sortante.<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>   <strong>  ip_version   <\/strong>  <\/td>\r\n<td>Version du protocole IPv4 ou IPv6.<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>   <strong>  post_nat_source_ipv4   <\/strong>  <\/td>\r\n<td>IPv4 NAT source.<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>   <strong>  post_nat_source_port   <\/strong>  <\/td>\r\n<td>Port NAT source.<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>   <strong>  frgmt_delta_packs   <\/strong>  <\/td>\r\n<td>Delta des paquets fragment\u00e9s.<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>   <strong>  repeat_delta_pack   <\/strong>  <\/td>\r\n<td>Delta des retransmissions.<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>   <strong>  packet_deliver_time   <\/strong>  <\/td>\r\n<td>D\u00e9lai (RTT\/2), ms.<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>   <strong>  protocol_code   <\/strong>  <\/td>\r\n<td>Code de protocole utilisant la classe de syst\u00e8me autonome pour le r\u00e9seau de neurones.<\/td>\r\n<\/tr>\r\n<\/tbody>\r\n<\/table>\r\n<h2>Traitement des donn\u00e9es avant l\u2019entra\u00eenement<\/h2>\r\nLes donn\u00e9es ont \u00e9t\u00e9 divis\u00e9es en ensembles d\u2019entra\u00eenement (80 %) et de test (20 %). Des ajustements d\u2019\u00e9quilibrage de classe et un \u00e9tiquetage des donn\u00e9es IPFIX ont \u00e9t\u00e9 appliqu\u00e9s pour mettre en \u00e9vidence des classes sp\u00e9cifiques.\r\n<h2>Entra\u00eenement<\/h2>\r\nLes r\u00e9seaux de neurones ont \u00e9t\u00e9 entra\u00een\u00e9s en utilisant deux architectures avec ajustement des hyperparam\u00e8tres. Les ratios de classe de protocole dans l\u2019\u00e9chantillon d\u2019entra\u00eenement \u00e9taient :\r\n<table>\r\n<tbody>\r\n<tr>\r\n<td>Protocole<\/td>\r\n<td>Ratio<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>DNS<\/td>\r\n<td>18,67%<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>HTTP<\/td>\r\n<td>1,38%<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>HTTPS<\/td>\r\n<td>16,27%<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>DoH<\/td>\r\n<td>2,66%<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>ICMP<\/td>\r\n<td>4,83%<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>Bittorrent<\/td>\r\n<td>24,73%<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>AdGuard VPN<\/td>\r\n<td>2,34%<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>VPN Unlimited<\/td>\r\n<td>12,18%<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>Psiphon 3<\/td>\r\n<td>12,41%<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>Lantern<\/td>\r\n<td>4,53%<\/td>\r\n<\/tr>\r\n<\/tbody>\r\n<\/table>\r\n<h2>Tests<\/h2>\r\nLes mod\u00e8les ont \u00e9t\u00e9 \u00e9valu\u00e9s sur l\u2019ensemble de test en utilisant les m\u00e9triques de pr\u00e9cision, de rappel et de score F1 :\r\n\r\n<span class=\"katex-display\"><span class=\"katex\"><span class=\"katex-mathml\"><\/span><\/span><\/span>\r\n\r\n<math xmlns=\"http:\/\/www.w3.org\/1998\/Math\/MathML\" display=\"block\"><semantics><mrow><mtext>Rappel<\/mtext><mo>=<\/mo><mfrac><mtext>VP<\/mtext><mrow><mtext>VP<\/mtext><mo>+<\/mo><mtext>FN<\/mtext><\/mrow><\/mfrac><\/mrow><annotation encoding=\"application\/x-tex\">\\text{Rappel} = \\frac{\\text{VP}}{\\text{VP} + \\text{FN}}<\/annotation><\/semantics><\/math>\r\n\r\n<span class=\"katex-html\" aria-hidden=\"true\"><span class=\"base\"><span class=\"strut\"><\/span><span class=\"mord text\"><span class=\"mord\">Rappel<\/span><\/span><span class=\"mspace\"><\/span><span class=\"mrel\">=<\/span><span class=\"mspace\"><\/span><\/span><span class=\"base\"><span class=\"strut\"><\/span><span class=\"mord\"><span class=\"mopen nulldelimiter\"><\/span><span class=\"mfrac\"><span class=\"vlist-t vlist-t2\"><span class=\"vlist-r\"><span class=\"vlist\"><span><span class=\"pstrut\"><\/span><span class=\"mord text\">VP<\/span><span class=\"mspace\"><\/span><span class=\"mbin\">+<\/span><span class=\"mspace\"><\/span><span class=\"mord text\">FN<\/span><\/span><span><span class=\"pstrut\"><\/span><span class=\"frac-line\"><\/span><\/span><span><span class=\"pstrut\"><\/span><span class=\"mord text\">VP<\/span><\/span><\/span><span class=\"vlist-s\">\u200b<\/span><\/span><span class=\"vlist-r\"><span class=\"vlist\"><span><\/span><\/span><\/span><\/span><\/span><span class=\"mclose nulldelimiter\"><\/span><\/span><\/span><\/span> <span class=\"katex-display\"><span class=\"katex\"><span class=\"katex-mathml\"><\/span><\/span><\/span>\r\n\r\n<math xmlns=\"http:\/\/www.w3.org\/1998\/Math\/MathML\" display=\"block\"><semantics><mrow><mrow><mtext>Pr<\/mtext><mover accent=\"true\"><mtext>e<\/mtext><mo>\u02ca<\/mo><\/mover><mtext>cision<\/mtext><\/mrow><mo>=<\/mo><mfrac><mtext>VP<\/mtext><mrow><mtext>VP<\/mtext><mo>+<\/mo><mtext>FP<\/mtext><\/mrow><\/mfrac><\/mrow><annotation encoding=\"application\/x-tex\">\\text{Pr\u00e9cision} = \\frac{\\text{VP}}{\\text{VP} + \\text{FP}}<\/annotation><\/semantics><\/math>\r\n\r\n<span class=\"katex-html\" aria-hidden=\"true\"><span class=\"base\"><span class=\"strut\"><\/span><span class=\"mord text\"><span class=\"mord\">Pr<\/span><span class=\"mord accent\"><span class=\"vlist-t\"><span class=\"vlist-r\"><span class=\"vlist\"><span><span class=\"pstrut\"><\/span><span class=\"mord\">e<\/span><\/span><span><span class=\"pstrut\"><\/span><span class=\"accent-body\"><span class=\"mord\">\u02ca<\/span><\/span><\/span><\/span><\/span><\/span><\/span><span class=\"mord\">cision<\/span><\/span><span class=\"mspace\"><\/span><span class=\"mrel\">=<\/span><span class=\"mspace\"><\/span><\/span><span class=\"base\"><span class=\"strut\"><\/span><span class=\"mord\"><span class=\"mopen nulldelimiter\"><\/span><span class=\"mfrac\"><span class=\"vlist-t vlist-t2\"><span class=\"vlist-r\"><span class=\"vlist\"><span><span class=\"pstrut\"><\/span><span class=\"mord text\">VP<\/span><span class=\"mspace\"><\/span><span class=\"mbin\">+<\/span><span class=\"mspace\"><\/span><span class=\"mord text\">FP<\/span><\/span><span><span class=\"pstrut\"><\/span><span class=\"frac-line\"><\/span><\/span><span><span class=\"pstrut\"><\/span><span class=\"mord text\">VP<\/span><\/span><\/span><span class=\"vlist-s\">\u200b<\/span><\/span><span class=\"vlist-r\"><span class=\"vlist\"><span><\/span><\/span><\/span><\/span><\/span><span class=\"mclose nulldelimiter\"><\/span><\/span><\/span><\/span> <span class=\"katex-display\"><span class=\"katex\"><span class=\"katex-mathml\"><\/span><\/span><\/span>\r\n\r\n<math xmlns=\"http:\/\/www.w3.org\/1998\/Math\/MathML\" display=\"block\"><semantics><mrow><mtext>Score\u00a0F1<\/mtext><mo>=<\/mo><mfrac><mrow><mn>2<\/mn><mo>\u00d7<\/mo><mtext>Rappel<\/mtext><mo>\u00d7<\/mo><mrow><mtext>Pr<\/mtext><mover accent=\"true\"><mtext>e<\/mtext><mo>\u02ca<\/mo><\/mover><mtext>cision<\/mtext><\/mrow><\/mrow><mrow><mtext>Rappel<\/mtext><mo>+<\/mo><mrow><mtext>Pr<\/mtext><mover accent=\"true\"><mtext>e<\/mtext><mo>\u02ca<\/mo><\/mover><mtext>cision<\/mtext><\/mrow><\/mrow><\/mfrac><\/mrow><annotation encoding=\"application\/x-tex\">\\text{Score F1} = \\frac{2 \\times \\text{Rappel} \\times \\text{Pr\u00e9cision}}{\\text{Rappel} + \\text{Pr\u00e9cision}}<\/annotation><\/semantics><\/math>\r\n\r\n<span class=\"katex-html\" aria-hidden=\"true\"><span class=\"base\"><span class=\"strut\"><\/span><span class=\"mord text\"><span class=\"mord\">Score\u00a0F1<\/span><\/span><span class=\"mspace\"><\/span><span class=\"mrel\">=<\/span><span class=\"mspace\"><\/span><\/span><span class=\"base\"><span class=\"strut\"><\/span><span class=\"mord\"><span class=\"mopen nulldelimiter\"><\/span><span class=\"mfrac\"><span class=\"vlist-t vlist-t2\"><span class=\"vlist-r\"><span class=\"vlist\"><span><span class=\"pstrut\"><\/span><span class=\"mord text\">Rappel<\/span><span class=\"mspace\"><\/span><span class=\"mbin\">+<\/span><span class=\"mspace\"><\/span><span class=\"mord text\">Pr<span class=\"mord accent\"><span class=\"vlist-t\"><span class=\"pstrut\"><\/span>e<span class=\"pstrut\"><\/span><span class=\"accent-body\">\u02ca<\/span><\/span><\/span>cision<\/span><\/span><span><span class=\"pstrut\"><\/span><span class=\"frac-line\"><\/span><\/span><span><span class=\"pstrut\"><\/span>2<span class=\"mspace\"><\/span><span class=\"mbin\">\u00d7<\/span><span class=\"mspace\"><\/span><span class=\"mord text\">Rappel<\/span><span class=\"mspace\"><\/span><span class=\"mbin\">\u00d7<\/span><span class=\"mspace\"><\/span><span class=\"mord text\">Pr<span class=\"mord accent\"><span class=\"vlist-t\"><span class=\"pstrut\"><\/span>e<span class=\"pstrut\"><\/span><span class=\"accent-body\">\u02ca<\/span><\/span><\/span>cision<\/span><\/span><\/span><span class=\"vlist-s\">\u200b<\/span><\/span><span class=\"vlist-r\"><span class=\"vlist\"><span><\/span><\/span><\/span><\/span><\/span><span class=\"mclose nulldelimiter\"><\/span><\/span><\/span><\/span>\r\n\r\no\u00f9 VP d\u00e9signe les vrais positifs, FN les faux n\u00e9gatifs et FP les faux positifs.\r\n\r\nL\u2019exp\u00e9rience a \u00e9t\u00e9 men\u00e9e sur des VPNs avec une large gamme d\u2019adresses IP pour am\u00e9liorer l\u2019objectivit\u00e9 des r\u00e9sultats. Le mod\u00e8le d\u2019architecture ResNet a d\u00e9montr\u00e9 une meilleure pr\u00e9cision dans la classification des protocoles VPN.\r\n<h2>R\u00e9sultats<\/h2>\r\n   <strong>  R\u00e9seau neuronal classique   <\/strong>  \r\n\r\nProtocoleVPFPFNScore F1\r\n<table>\r\n<tbody>\r\n<tr>\r\n<td>AdGuard VPN<\/td>\r\n<td>28<\/td>\r\n<td>9<\/td>\r\n<td>50<\/td>\r\n<td>0,49<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>VPN Unlimited<\/td>\r\n<td>3<\/td>\r\n<td>3<\/td>\r\n<td>22<\/td>\r\n<td>0,21<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>Psiphon 3<\/td>\r\n<td>8455<\/td>\r\n<td>160<\/td>\r\n<td>399<\/td>\r\n<td>0,97<\/td>\r\n<\/tr>\r\n<\/tbody>\r\n<\/table>\r\n   <strong>  Architecture ResNet   <\/strong>  \r\n<table>\r\n<tbody>\r\n<tr>\r\n<td>Protocole<\/td>\r\n<td>VP<\/td>\r\n<td>FP<\/td>\r\n<td>FN<\/td>\r\n<td>Score F1<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>AdGuard VPN<\/td>\r\n<td>60<\/td>\r\n<td>5<\/td>\r\n<td>18<\/td>\r\n<td>0,84<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>VPN Unlimited<\/td>\r\n<td>5<\/td>\r\n<td>9<\/td>\r\n<td>20<\/td>\r\n<td>0,26<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>Psiphon 3<\/td>\r\n<td>8847<\/td>\r\n<td>1030<\/td>\r\n<td>7<\/td>\r\n<td>0,95<\/td>\r\n<\/tr>\r\n<\/tbody>\r\n<\/table>\r\nL\u2019architecture ResNet a montr\u00e9 une plus grande efficacit\u00e9 dans l\u2019identification du trafic VPN et peut servir de base fiable pour les t\u00e2ches de classification du trafic chiffr\u00e9.\r\n<h2>Conclusion<\/h2>\r\nDans cet article, nous avons examin\u00e9 les m\u00e9thodes d\u2019identification du trafic obfusqu\u00e9, en couvrant \u00e0 la fois les approches classiques et celles bas\u00e9es sur les r\u00e9seaux de neurones. Bien que les m\u00e9thodes traditionnelles offrent des capacit\u00e9s de base, elles pr\u00e9sentent des limites dans des environnements de trafic dynamique et de chiffrement. Les r\u00e9seaux de neurones modernes offrent une pr\u00e9cision et une flexibilit\u00e9 accrues, permettant d\u2019identifier efficacement le trafic obfusqu\u00e9 m\u00eame lorsque les m\u00e9thodes traditionnelles s\u2019av\u00e8rent inefficaces. Ainsi, le passage aux approches bas\u00e9es sur les r\u00e9seaux de neurones marque une avanc\u00e9e significative dans la s\u00e9curit\u00e9 des r\u00e9seaux.","protected":false},"excerpt":{"rendered":"<p>L&rsquo;analyse et la classification du trafic r\u00e9seau sont devenues essentielles pour maintenir la r\u00e9silience et la s\u00e9curit\u00e9 des r\u00e9seaux informatiques contemporains. Avec l&rsquo;augmentation rapide des volumes de donn\u00e9es et la complexit\u00e9 croissante des m\u00e9thodes de cryptage, le besoin d&rsquo;une classification efficace des flux r\u00e9seau ne cesse de cro\u00eetre. En identifiant, cat\u00e9gorisant et analysant le trafic r\u00e9seau avec pr\u00e9cision, les entreprises peuvent d\u00e9tecter les menaces potentielles, optimiser les performances du r\u00e9seau et garantir la conformit\u00e9 avec les protocoles de s\u00e9curit\u00e9.<\/p>\n","protected":false},"author":24,"featured_media":11203,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[48],"tags":[],"class_list":["post-11200","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-telecom"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.1 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>(English) VASExperts<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/vasexperts.com\/blog\/telecom\/from-classical-methods-to-neural-networks-exploring-the-potential-of-deep-learning-in-identifying-obfuscated-traffic\/\",\"url\":\"https:\/\/vasexperts.com\/blog\/telecom\/from-classical-methods-to-neural-networks-exploring-the-potential-of-deep-learning-in-identifying-obfuscated-traffic\/\",\"name\":\"[:br]Dos m\u00e9todos cl\u00e1ssicos \u00e0s redes neurais: Explorando o potencial da aprendizagem profunda na identifica\u00e7\u00e3o de tr\u00e1fego ofuscado[:fr]Des m\u00e9thodes classiques aux r\u00e9seaux neuronaux : Exploration du potentiel de l'apprentissage profond dans l'identification du trafic obscurci[:es]De los m\u00e9todos cl\u00e1sicos a las redes neuronales: Explorando el potencial del Deep Learning en la identificaci\u00f3n de tr\u00e1fico ofuscado[:en]From classical methods to neural networks: Exploring the potential of Deep Learning in identifying obfuscated traffic[:] - (English) VASExperts\",\"isPartOf\":{\"@id\":\"https:\/\/vasexperts.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/vasexperts.com\/blog\/telecom\/from-classical-methods-to-neural-networks-exploring-the-potential-of-deep-learning-in-identifying-obfuscated-traffic\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/vasexperts.com\/blog\/telecom\/from-classical-methods-to-neural-networks-exploring-the-potential-of-deep-learning-in-identifying-obfuscated-traffic\/#primaryimage\"},\"thumbnailUrl\":\"\/wp-content\/uploads\/2024\/10\/frame-1321314805-1.jpg\",\"datePublished\":\"2024-10-30T16:48:19+00:00\",\"dateModified\":\"2025-08-11T11:13:31+00:00\",\"author\":{\"@id\":\"https:\/\/vasexperts.com\/#\/schema\/person\/f27674e15c2c6c09c36db4e68f9dd198\"},\"description\":\"[:en]Explore the transition from classical methods to deep learning in identifying obfuscated traffic. Learn how neural networks can enhance network performance and security in telecommunications.[:es]Explora la transici\u00f3n de los m\u00e9todos cl\u00e1sicos al aprendizaje profundo en la identificaci\u00f3n del tr\u00e1fico ofuscado. Descubre c\u00f3mo las redes neuronales pueden mejorar el rendimiento y la seguridad de las telecomunicaciones.[:fr]Explorez la transition des m\u00e9thodes classiques vers l\u2019apprentissage profond pour identifier le trafic obscurci. D\u00e9couvrez comment les r\u00e9seaux neuronaux peuvent am\u00e9liorer les performances et la s\u00e9curit\u00e9 des t\u00e9l\u00e9communications.[:br]Explore a transi\u00e7\u00e3o dos m\u00e9todos cl\u00e1ssicos para o deep learning na identifica\u00e7\u00e3o de tr\u00e1fego ofuscado. Saiba como as redes neurais podem melhorar o desempenho e a seguran\u00e7a nas telecomunica\u00e7\u00f5es.\",\"breadcrumb\":{\"@id\":\"https:\/\/vasexperts.com\/blog\/telecom\/from-classical-methods-to-neural-networks-exploring-the-potential-of-deep-learning-in-identifying-obfuscated-traffic\/#breadcrumb\"},\"inLanguage\":\"fr-FR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/vasexperts.com\/blog\/telecom\/from-classical-methods-to-neural-networks-exploring-the-potential-of-deep-learning-in-identifying-obfuscated-traffic\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\/\/vasexperts.com\/blog\/telecom\/from-classical-methods-to-neural-networks-exploring-the-potential-of-deep-learning-in-identifying-obfuscated-traffic\/#primaryimage\",\"url\":\"\/wp-content\/uploads\/2024\/10\/frame-1321314805-1.jpg\",\"contentUrl\":\"\/wp-content\/uploads\/2024\/10\/frame-1321314805-1.jpg\",\"width\":1000,\"height\":460},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/vasexperts.com\/blog\/telecom\/from-classical-methods-to-neural-networks-exploring-the-potential-of-deep-learning-in-identifying-obfuscated-traffic\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u0413\u043b\u0430\u0432\u043d\u0430\u044f \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0430\",\"item\":\"https:\/\/vasexperts.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"From classical methods to neural networks: Exploring the potential of Deep Learning in identifying obfuscated traffic\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/vasexperts.com\/#website\",\"url\":\"https:\/\/vasexperts.com\/\",\"name\":\"ITGLOBAL.COM\",\"description\":\"(English) VASExperts\",\"inLanguage\":\"fr-FR\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/vasexperts.com\/#\/schema\/person\/f27674e15c2c6c09c36db4e68f9dd198\",\"name\":\"Darya Aulova\",\"url\":\"https:\/\/vasexperts.com\/fr\/blog\/author\/darya-aulova\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"(English) VASExperts","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/vasexperts.com\/blog\/telecom\/from-classical-methods-to-neural-networks-exploring-the-potential-of-deep-learning-in-identifying-obfuscated-traffic\/","url":"https:\/\/vasexperts.com\/blog\/telecom\/from-classical-methods-to-neural-networks-exploring-the-potential-of-deep-learning-in-identifying-obfuscated-traffic\/","name":"[:br]Dos m\u00e9todos cl\u00e1ssicos \u00e0s redes neurais: Explorando o potencial da aprendizagem profunda na identifica\u00e7\u00e3o de tr\u00e1fego ofuscado[:fr]Des m\u00e9thodes classiques aux r\u00e9seaux neuronaux : Exploration du potentiel de l'apprentissage profond dans l'identification du trafic obscurci[:es]De los m\u00e9todos cl\u00e1sicos a las redes neuronales: Explorando el potencial del Deep Learning en la identificaci\u00f3n de tr\u00e1fico ofuscado[:en]From classical methods to neural networks: Exploring the potential of Deep Learning in identifying obfuscated traffic[:] - (English) VASExperts","isPartOf":{"@id":"https:\/\/vasexperts.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/vasexperts.com\/blog\/telecom\/from-classical-methods-to-neural-networks-exploring-the-potential-of-deep-learning-in-identifying-obfuscated-traffic\/#primaryimage"},"image":{"@id":"https:\/\/vasexperts.com\/blog\/telecom\/from-classical-methods-to-neural-networks-exploring-the-potential-of-deep-learning-in-identifying-obfuscated-traffic\/#primaryimage"},"thumbnailUrl":"\/wp-content\/uploads\/2024\/10\/frame-1321314805-1.jpg","datePublished":"2024-10-30T16:48:19+00:00","dateModified":"2025-08-11T11:13:31+00:00","author":{"@id":"https:\/\/vasexperts.com\/#\/schema\/person\/f27674e15c2c6c09c36db4e68f9dd198"},"description":"[:en]Explore the transition from classical methods to deep learning in identifying obfuscated traffic. Learn how neural networks can enhance network performance and security in telecommunications.[:es]Explora la transici\u00f3n de los m\u00e9todos cl\u00e1sicos al aprendizaje profundo en la identificaci\u00f3n del tr\u00e1fico ofuscado. Descubre c\u00f3mo las redes neuronales pueden mejorar el rendimiento y la seguridad de las telecomunicaciones.[:fr]Explorez la transition des m\u00e9thodes classiques vers l\u2019apprentissage profond pour identifier le trafic obscurci. D\u00e9couvrez comment les r\u00e9seaux neuronaux peuvent am\u00e9liorer les performances et la s\u00e9curit\u00e9 des t\u00e9l\u00e9communications.[:br]Explore a transi\u00e7\u00e3o dos m\u00e9todos cl\u00e1ssicos para o deep learning na identifica\u00e7\u00e3o de tr\u00e1fego ofuscado. Saiba como as redes neurais podem melhorar o desempenho e a seguran\u00e7a nas telecomunica\u00e7\u00f5es.","breadcrumb":{"@id":"https:\/\/vasexperts.com\/blog\/telecom\/from-classical-methods-to-neural-networks-exploring-the-potential-of-deep-learning-in-identifying-obfuscated-traffic\/#breadcrumb"},"inLanguage":"fr-FR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/vasexperts.com\/blog\/telecom\/from-classical-methods-to-neural-networks-exploring-the-potential-of-deep-learning-in-identifying-obfuscated-traffic\/"]}]},{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/vasexperts.com\/blog\/telecom\/from-classical-methods-to-neural-networks-exploring-the-potential-of-deep-learning-in-identifying-obfuscated-traffic\/#primaryimage","url":"\/wp-content\/uploads\/2024\/10\/frame-1321314805-1.jpg","contentUrl":"\/wp-content\/uploads\/2024\/10\/frame-1321314805-1.jpg","width":1000,"height":460},{"@type":"BreadcrumbList","@id":"https:\/\/vasexperts.com\/blog\/telecom\/from-classical-methods-to-neural-networks-exploring-the-potential-of-deep-learning-in-identifying-obfuscated-traffic\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u0413\u043b\u0430\u0432\u043d\u0430\u044f \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0430","item":"https:\/\/vasexperts.com\/"},{"@type":"ListItem","position":2,"name":"From classical methods to neural networks: Exploring the potential of Deep Learning in identifying obfuscated traffic"}]},{"@type":"WebSite","@id":"https:\/\/vasexperts.com\/#website","url":"https:\/\/vasexperts.com\/","name":"ITGLOBAL.COM","description":"(English) VASExperts","inLanguage":"fr-FR"},{"@type":"Person","@id":"https:\/\/vasexperts.com\/#\/schema\/person\/f27674e15c2c6c09c36db4e68f9dd198","name":"Darya Aulova","url":"https:\/\/vasexperts.com\/fr\/blog\/author\/darya-aulova\/"}]}},"_links":{"self":[{"href":"https:\/\/vasexperts.com\/fr\/wp-json\/wp\/v2\/posts\/11200"}],"collection":[{"href":"https:\/\/vasexperts.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vasexperts.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vasexperts.com\/fr\/wp-json\/wp\/v2\/users\/24"}],"replies":[{"embeddable":true,"href":"https:\/\/vasexperts.com\/fr\/wp-json\/wp\/v2\/comments?post=11200"}],"version-history":[{"count":11,"href":"https:\/\/vasexperts.com\/fr\/wp-json\/wp\/v2\/posts\/11200\/revisions"}],"predecessor-version":[{"id":12763,"href":"https:\/\/vasexperts.com\/fr\/wp-json\/wp\/v2\/posts\/11200\/revisions\/12763"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vasexperts.com\/fr\/wp-json\/wp\/v2\/media\/11203"}],"wp:attachment":[{"href":"https:\/\/vasexperts.com\/fr\/wp-json\/wp\/v2\/media?parent=11200"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vasexperts.com\/fr\/wp-json\/wp\/v2\/categories?post=11200"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vasexperts.com\/fr\/wp-json\/wp\/v2\/tags?post=11200"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}