Towards a Near-real-time Protocol Tunneling Detector based on Machine Learning Techniques

Aug 4, 2026

Upload by Anda

Cybersecurity attacks are accelerating rapidly in volume, sophistication, and cost, affecting both organizations and critical infrastructures. Expanded network perimeters during the COVID-19 period increased exploitable attack surface via malware and phishing, making continuous monitoring of network events essential. A near real-time protocol tunneling detector prototype inspects unencrypted network flows, extracts traffic features, and combines machine learning and deep learning to identify tunneling attacks, anomalies, and malicious patterns. The prototype is evaluated on benign and malicious datasets, achieving 97.1% overall accuracy and an F1-score of 95.6%.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages12

Reading Time30 min

AccessFree to download

Introduction

Problem context and motivation

Near real-time protocol tunneling detection approach

Article Towards a Near-real-time Protocol Tunneling Detector based on Machine Learning Techniques Filippo Sobrero 1, Beatrice Clavarezza 1, Daniele Ucci 1, and Federica Bisio 1 Citation: Sobrero, F.; Clavarezza, B.; Ucci, D.; Bisio, F. Towards a Near-real-time Protocol Tunneling Detector based on Machine Learning Techniques. J. Cybersecur. Priv. 2023, 1, 1–12. [https://doi.org/](https://doi.org/) Received: Revised: Accepted: Published: Copyright: © 2023 by the authors. Submitted to J. Cybersecur. Priv. for possible open access publication under the terms and conditions of the Creative Commons Attribution (CC BY) license ([https://](https://)[ ](https://)[creativecommons.org/licenses/by/](creativecommons.org/licenses/by/)[ ](creativecommons.org/licenses/by/)[4.0/](4.0/)) . arXiv :2309 . 12720v1 [ cs .CR] 22 Sep 2023 1 aizoOn Technology Consulting; [name.surname@aizoongroup.com](name.surname@aizoongroup.com) † This paper is an extended version of our paper published in IEEE Symposium Series on Computational Intelligence, 2021 . Abstract: In the very last years, cybersecurity attacks have increased at an unprecedented pace, becoming ever more sophisticated and costly. Their impact has involved both private/public companies and critical infrastructures. At the same time, due to the COVID-19 pandemic, the security perimeters of many organizations expanded, causing an increase of the attack surface exploitable by threat actors through malware and phishing attacks. Given these factors, it is of primary importance to monitor the security perimeter and the events occurring in the monitored network, according toa tested security strategy of detection and response. In this paper, we present a protocol tunneling detector prototype which inspects, in near real time, a company’s network traffic using machine learning techniques. Indeed, tunneling attacks allow malicious actors to maximize the time in which their activity remains undetected. The detector monitors unencrypted network flows and extracts features to detect possible occurring attacks and anomalies, by combining machine learning and deep learning. The proposed module can be embedded in any network security monitoring platform able to provide network flow information along with its metadata. The detection capabilities of the implemented prototype have been tested both on benign and malicious datasets. Results show 97.1% overall accuracy and an F1-score equals to 95.6% . Keywords: passive network analysis; dns tunneling; anomaly detection; machine learning; deep learning 1. Introduction Cybersecurity attacks keep increasing year over year at an unprecedented pace, becoming ever more sophisticated and costly [1,2] . The growth between 2021 and 2022 has resulted in a rise of attacks’ volume and impact on both private/public companies and critical infrastructures. Companies comprise digital service providers, public administrationsand governments, and include businesses operating in finance and health sectors. In particular, service providers have experimented more than 15% raise in intrusions (infamous has been the case of Solarwinds [3]) compared to 2021 [1], a trend destined to grow in the next years [4] . At the same time, due to the COVID-19 pandemic, the security perimeters of many organizations expanded to cope with the new needs of remote working, causing an increase of the attack surface exploitable by attackers [4] . The European Union Agency for Cybersecurity estimates that more than 10 terabytes of data are stolen monthly from target assets that are made unavailable, until a ransom is payed [1], while IBM calculates that the average cost of these attacks is $4.54M, arriving up to $5.12M [2] . On the other hand, malware attacks are still on the rise after the pause recorded during the pandemic and phishing continues to be the common attack vector for initial access [1] . Given these factors, it is of primary importance to monitor the securi

FAQs

What security problem does the proposed detector address?

It addresses tunneling attacks that encapsulate malicious communication inside legitimate protocols, allowing activity to remain undetected for longer.

How does the detector operate in terms of traffic visibility and timing?

It inspects network traffic in near real time and focuses on unencrypted (cleartext) protocols, extracting features from network flows for detection.

What machine learning methods are used and how effective is the prototype?

The detector combines machine learning and deep learning. Tested results on benign and malicious datasets report 97.1% overall accuracy and an F1-score of 95.6%.

Aug 4, 2026

Upload by Anda