Detecting ShadowsocksR User Based on Intelligence of Cyber Entities

<table class="table-group" id="tab4"><tr><td><table class="table"><tr><td class="thead-hr" colspan="5"><hr/></td></tr><tr class="thead"><td class="align_center" colspan="5">Feature name</td></tr><tr><td class="thead-hr" colspan="5"><hr/></td></tr><tr><td class="align_left">s_packet_count</td><td class="align_center">s_packet_length</td><td class="align_center">s_duration</td><td class="align_center">s_avg_packet_count</td><td class="align_center">s_avg_packet_length</td></tr><tr><td class="align_left">s_min_packet_length</td><td class="align_center">s_max_packet_length</td><td class="align_center">s_std_packet_length</td><td class="align_center">s_std_packet_count</td><td class="align_center">s_packet_tilt</td></tr><tr><td class="align_left">s_min_packet_count</td><td class="align_center"><b>s_</b>max_packet_count</td><td class="align_center"><span style="width: 62.9685ptpx;"><svg height="11.5564pt" id="M23" style="vertical-align:-2.26807pt" version="1.1" viewbox="-0.0498162 -9.28833 62.9685 11.5564" width="62.9685pt" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><g transform="matrix(.013,0,0,-0.013,0,0)"><path d="M352 391C352 416 319 448 267 448C236 448 173 423 147 400C107 364 96 332 96 304C96 248 143 210 193 181C241 153 258 124 258 100C258 72 232 38 184 38C151 38 107 66 81 108C77 114 64 116 55 111C34 99 23 84 23 65C23 29 81 -12 134 -12C220 -12 325 61 325 141C325 184 297 215 234 256C194 282 161 309 161 346C161 380 188 401 217 401C255 401 279 380 301 353C308 344 313 341 325 347C341 355 352 371 352 391Z"></path></g><rect height="0.3985" width="3.91466" x="5.65813" y="-0.3985"></rect><g transform="matrix(.013,0,0,-0.013,9.573,0)"><path d="M645 631C614 643 545 666 457 666C215 666 23 519 23 283C23 90 158 -16 337 -16C412 -16 489 2 522 10C543 39 590 127 606 167L580 181C519 89 459 18 348 18C201 18 122 136 122 287C122 464 244 632 435 632C544 632 602 595 608 472L639 475C643 526 645 581 645 631Z"></path></g><g transform="matrix(.013,0,0,-0.013,18.257,0)"><path d="M445 282C445 390 384 448 297 448C266 448 231 437 189 418C96 376 23 279 23 151C23 65 66 -12 169 -12C233 -12 294 18 337 53C411 113 445 201 445 282ZM355 280C355 161 302 62 243 36C231 31 219 30 207 30C147 30 111 78 111 154C111 302 180 380 220 399C231 404 246 407 264 407C311 407 355 367 355 280Z"></path></g><g transform="matrix(.013,0,0,-0.013,24.341,0)"><path d="M515 96L502 119C471 88 431 62 423 62C416 62 411 70 417 101C440 223 469 341 497 448H486L412 422L380 277C330 188 210 57 152 57C137 57 126 69 139 124L195 366C210 431 205 448 182 448C155 448 89 413 23 350L36 326C73 354 103 376 112 376C118 376 118 365 113 340L61 118C54 90 52 68 52 51C52 0 75 -12 98 -12S151 -3 181 17C242 58 305 119 362 193H364L345 104C323 3 339 -12 359 -12C390 -12 464 35 515 96Z"></path></g><g transform="matrix(.013,0,0,-0.013,31.336,0)"><path d="M495 86L479 114C446 82 419 66 409 66C401 66 401 72 406 97C420 166 436 231 453 297C489 435 454 448 428 448C406 448 384 439 354 422C305 394 222 327 161 247H159L183 345C200 415 194 448 173 448C143 448 82 410 23 351L38 325C64 349 95 371 105 371C111 371 116 365 109 336L25 -4L31 -12C50 -4 77 3 107 9C119 69 132 122 145 168C197 254 321 381 370 381C387 381 393 374 378 305L329 95C309 17 320 -12 345 -12C372 -12 430 19 495 86Z"></path></g><g transform="matrix(.013,0,0,-0.013,37.862,0)"><path d="M324 430H196L233 583L223 592L145 529L120 430H54L29 396L31 388H111L56 126C33 15 54 -12 77 -12C137 -12 214 57 250 95L233 119C208 92 155 59 138 59C126 59 120 70 131 125L186 390L298 394L324 430Z"></path></g><g transform="matrix(.013,0,0,-0.013,42.295,0)"><path d="M300 -147C201 -63 143 98 143 270S200 602 300 686L282 710C136 610 70 450 70 271V270C70 89 136 -72 282 -170L300 -147Z"></path></g><g transform="matrix(.013,0,0,-0.013,46.793,0)"><path d="M383 397C383 424 344 448 299 448C244 448 172 409 132 375C66 319 23 227 23 146C23 42 74 -12 146 -12C208 -12 298 30 359 103L343 124C315 95 248 48 192 48C145 48 111 85 111 163C111 228 129 294 151 330C171 363 201 401 241 401C275 401 302 384 325 356C332 347 339 344 348 348C373 360 383 381 383 397Z"></path></g><g transform="matrix(.013,0,0,-0.013,52.075,0)"><path d="M445 282C445 390 384 448 297 448C266 448 231 437 189 418C96 376 23 279 23 151C23 65 66 -12 169 -12C233 -12 294 18 337 53C411 113 445 201 445 282ZM355 280C355 161 302 62 243 36C231 31 219 30 207 30C147 30 111 78 111 154C111 302 180 380 220 399C231 404 246 407 264 407C311 407 355 367 355 280Z"></path></g><g transform="matrix(.013,0,0,-0.013,58.159,0)"><path d="M275 270C275 450 212 609 64 710L45 686C145 604 203 442 203 270S147 -63 45 -147L64 -170C213 -68 275 89 275 270Z"></path></g></svg></span></td><td class="align_center"><span style="width: 39.2328ptpx;"><svg height="12.7178pt" id="M24" style="vertical-align:-3.42947pt" version="1.1" viewbox="-0.0498162 -9.28833 39.2328 12.7178" width="39.2328pt" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><g transform="matrix(.013,0,0,-0.013,0,0)"><path d="M352 391C352 416 319 448 267 448C236 448 173 423 147 400C107 364 96 332 96 304C96 248 143 210 193 181C241 153 258 124 258 100C258 72 232 38 184 38C151 38 107 66 81 108C77 114 64 116 55 111C34 99 23 84 23 65C23 29 81 -12 134 -12C220 -12 325 61 325 141C325 184 297 215 234 256C194 282 161 309 161 346C161 380 188 401 217 401C255 401 279 380 301 353C308 344 313 341 325 347C341 355 352 371 352 391Z"></path></g><rect height="0.3985" width="3.91466" x="5.65813" y="-0.3985"></rect><g transform="matrix(.013,0,0,-0.013,9.573,0)"><path d="M743 375C743 570 607 650 407 650H136L130 622C214 612 220 606 204 526L125 122C110 43 105 36 24 27L17 0H250C382 0 482 23 571 76C680 141 743 248 743 375ZM644 379C644 188 520 36 305 36C277 36 249 38 229 46C205 55 202 71 212 126L293 553C300 588 306 600 317 606C330 613 356 617 390 617C547 617 644 537 644 379Z"></path></g><g transform="matrix(.013,0,0,-0.013,19.531,0)"><path d="M300 -147C201 -63 143 98 143 270S200 602 300 686L282 710C136 610 70 450 70 271V270C70 89 136 -72 282 -170L300 -147Z"></path></g><g transform="matrix(.013,0,0,-0.013,24.029,0)"><path d="M244 607C244 633 228 655 200 655C166 655 146 618 146 594C146 564 166 546 191 546C221 546 244 574 244 607ZM222 91L209 114C184 94 148 66 133 66C127 66 124 73 130 96L201 370C213 416 211 448 191 448C162 448 88 407 29 352L42 328C73 354 104 371 114 371C120 371 119 365 115 345L53 92C32 5 45 -12 68 -12C103 -12 186 50 222 91Z"></path></g><g transform="matrix(.013,0,0,-0.013,26.795,0)"><path d="M570 304C570 398 525 448 414 448C385 448 343 445 312 434L329 511L321 518C297 504 262 482 244 460L233 411C195 397 159 381 128 358L135 332C160 347 189 360 224 373L111 -147C97 -210 84 -218 17 -231L13 -257L254 -247L259 -218L233 -216C183 -212 177 -202 189 -142L218 -1C238 -10 266 -12 283 -12C351 3 429 48 483 105C543 168 570 242 570 304ZM482 289C482 161 380 33 304 33C278 33 248 51 233 69L303 396C326 400 352 403 369 403C428 403 482 380 482 289Z"></path></g><g transform="matrix(.013,0,0,-0.013,34.506,0)"><path d="M275 270C275 450 212 609 64 710L45 686C145 604 203 442 203 270S147 -63 45 -147L64 -170C213 -68 275 89 275 270Z"></path></g></svg></span></td><td class="align_center"><span style="width: 66.9797ptpx;"><svg height="11.5564pt" id="M25" style="vertical-align:-2.26807pt" version="1.1" viewbox="-0.0498162 -9.28833 66.9797 11.5564" width="66.9797pt" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><g transform="matrix(.013,0,0,-0.013,0,0)"><path d="M743 375C743 570 607 650 407 650H136L130 622C214 612 220 606 204 526L125 122C110 43 105 36 24 27L17 0H250C382 0 482 23 571 76C680 141 743 248 743 375ZM644 379C644 188 520 36 305 36C277 36 249 38 229 46C205 55 202 71 212 126L293 553C300 588 306 600 317 606C330 613 356 617 390 617C547 617 644 537 644 379Z"></path></g><g transform="matrix(.013,0,0,-0.013,9.958,0)"><path d="M300 -147C201 -63 143 98 143 270S200 602 300 686L282 710C136 610 70 450 70 271V270C70 89 136 -72 282 -170L300 -147Z"></path></g><g transform="matrix(.013,0,0,-0.013,14.456,0)"><path d="M743 375C743 570 607 650 407 650H136L130 622C214 612 220 606 204 526L125 122C110 43 105 36 24 27L17 0H250C382 0 482 23 571 76C680 141 743 248 743 375ZM644 379C644 188 520 36 305 36C277 36 249 38 229 46C205 55 202 71 212 126L293 553C300 588 306 600 317 606C330 613 356 617 390 617C547 617 644 537 644 379Z"></path></g><g transform="matrix(.013,0,0,-0.013,24.414,0)"><path d="M445 282C445 390 384 448 297 448C266 448 231 437 189 418C96 376 23 279 23 151C23 65 66 -12 169 -12C233 -12 294 18 337 53C411 113 445 201 445 282ZM355 280C355 161 302 62 243 36C231 31 219 30 207 30C147 30 111 78 111 154C111 302 180 380 220 399C231 404 246 407 264 407C311 407 355 367 355 280Z"></path></g><g transform="matrix(.013,0,0,-0.013,34.849,0)"><path d="M766 88L752 113C719 83 690 64 681 64C674 64 672 74 679 103L724 292C758 436 724 448 701 448C680 448 666 442 639 429C594 407 514 350 441 252H439L447 289C476 423 450 448 419 448C398 448 379 441 355 427C307 400 234 344 162 249H160L180 324C203 409 197 448 170 448C144 448 82 413 23 349L35 321C57 343 96 374 108 374C115 374 117 371 111 341C87 227 57 112 24 -6L32 -12C53 -4 81 4 108 6C119 68 134 128 149 171C177 229 309 383 364 383C387 383 388 355 373 282C354 190 330 92 303 -6L309 -12C332 -4 356 3 386 6C396 63 411 122 424 171C458 236 590 383 642 383C658 383 664 369 652 315L603 91C587 20 593 -12 619 -12C642 -12 708 23 766 88Z"></path></g><g transform="matrix(.013,0,0,-0.013,45.106,0)"><path d="M483 97L471 123C436 91 401 65 392 65C388 65 384 74 390 106C414 239 444 378 457 429L455 433C444 433 429 436 416 439C392 444 368 448 344 448C281 448 204 415 152 376C71 315 23 205 23 103C23 21 57 -12 85 -12C114 -12 149 6 185 34C231 70 285 119 329 183H331L309 81C292 0 308 -12 326 -12C350 -12 421 24 483 97ZM374 387C370 363 356 291 345 261C315 193 181 50 139 50C124 50 110 71 110 118C110 224 153 331 218 379C238 394 271 402 301 402C329 402 359 394 374 387Z"></path></g><g transform="matrix(.013,0,0,-0.013,52.078,0)"><path d="M244 607C244 633 228 655 200 655C166 655 146 618 146 594C146 564 166 546 191 546C221 546 244 574 244 607ZM222 91L209 114C184 94 148 66 133 66C127 66 124 73 130 96L201 370C213 416 211 448 191 448C162 448 88 407 29 352L42 328C73 354 104 371 114 371C120 371 119 365 115 345L53 92C32 5 45 -12 68 -12C103 -12 186 50 222 91Z"></path></g><g transform="matrix(.013,0,0,-0.013,55.627,0)"><path d="M495 86L479 114C446 82 419 66 409 66C401 66 401 72 406 97C420 166 436 231 453 297C489 435 454 448 428 448C406 448 384 439 354 422C305 394 222 327 161 247H159L183 345C200 415 194 448 173 448C143 448 82 410 23 351L38 325C64 349 95 371 105 371C111 371 116 365 109 336L25 -4L31 -12C50 -4 77 3 107 9C119 69 132 122 145 168C197 254 321 381 370 381C387 381 393 374 378 305L329 95C309 17 320 -12 345 -12C372 -12 430 19 495 86Z"></path></g><g transform="matrix(.013,0,0,-0.013,62.154,0)"><path d="M275 270C275 450 212 609 64 710L45 686C145 604 203 442 203 270S147 -63 45 -147L64 -170C213 -68 275 89 275 270Z"></path></g></svg></span></td></tr><tr><td class="align_left">r_packet_count</td><td class="align_center">r_packet_length</td><td class="align_center">r_duration</td><td class="align_center">r_avg_packet_count</td><td class="align_center">r_avg_packet_length</td></tr><tr><td class="align_left">r_min_packet_length</td><td class="align_center">r_max_packet_length</td><td class="align_center">r_std_packet_length</td><td class="align_center">r_std_packet_count</td><td class="align_center">r_packet_tilt</td></tr><tr><td class="align_left">r_min_packet_count</td><td class="align_center">r<b>_</b>max_packet_count</td><td class="align_center"><span style="width: 63.5818ptpx;"><svg height="11.5564pt" id="M26" style="vertical-align:-2.26807pt" version="1.1" viewbox="-0.0498162 -9.28833 63.5818 11.5564" width="63.5818pt" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><g transform="matrix(.013,0,0,-0.013,0,0)"><path d="M393 379C402 394 400 411 393 422C384 437 365 448 348 448C301 448 237 372 186 285H182L193 335C210 408 205 448 178 448C150 448 80 402 29 344L45 321C80 355 114 373 122 373C128 373 130 365 124 330C106 228 76 98 50 -5L57 -12C82 -5 112 3 132 6L172 203C196 256 234 304 254 329C275 355 293 367 306 367C318 367 330 360 342 348C347 343 355 343 365 350S386 367 393 379Z"></path></g><rect height="0.3985" width="3.91466" x="6.27108" y="-0.3985"></rect><g transform="matrix(.013,0,0,-0.013,10.186,0)"><path d="M645 631C614 643 545 666 457 666C215 666 23 519 23 283C23 90 158 -16 337 -16C412 -16 489 2 522 10C543 39 590 127 606 167L580 181C519 89 459 18 348 18C201 18 122 136 122 287C122 464 244 632 435 632C544 632 602 595 608 472L639 475C643 526 645 581 645 631Z"></path></g><g transform="matrix(.013,0,0,-0.013,18.87,0)"><path d="M445 282C445 390 384 448 297 448C266 448 231 437 189 418C96 376 23 279 23 151C23 65 66 -12 169 -12C233 -12 294 18 337 53C411 113 445 201 445 282ZM355 280C355 161 302 62 243 36C231 31 219 30 207 30C147 30 111 78 111 154C111 302 180 380 220 399C231 404 246 407 264 407C311 407 355 367 355 280Z"></path></g><g transform="matrix(.013,0,0,-0.013,24.954,0)"><path d="M515 96L502 119C471 88 431 62 423 62C416 62 411 70 417 101C440 223 469 341 497 448H486L412 422L380 277C330 188 210 57 152 57C137 57 126 69 139 124L195 366C210 431 205 448 182 448C155 448 89 413 23 350L36 326C73 354 103 376 112 376C118 376 118 365 113 340L61 118C54 90 52 68 52 51C52 0 75 -12 98 -12S151 -3 181 17C242 58 305 119 362 193H364L345 104C323 3 339 -12 359 -12C390 -12 464 35 515 96Z"></path></g><g transform="matrix(.013,0,0,-0.013,31.948,0)"><path d="M495 86L479 114C446 82 419 66 409 66C401 66 401 72 406 97C420 166 436 231 453 297C489 435 454 448 428 448C406 448 384 439 354 422C305 394 222 327 161 247H159L183 345C200 415 194 448 173 448C143 448 82 410 23 351L38 325C64 349 95 371 105 371C111 371 116 365 109 336L25 -4L31 -12C50 -4 77 3 107 9C119 69 132 122 145 168C197 254 321 381 370 381C387 381 393 374 378 305L329 95C309 17 320 -12 345 -12C372 -12 430 19 495 86Z"></path></g><g transform="matrix(.013,0,0,-0.013,38.475,0)"><path d="M324 430H196L233 583L223 592L145 529L120 430H54L29 396L31 388H111L56 126C33 15 54 -12 77 -12C137 -12 214 57 250 95L233 119C208 92 155 59 138 59C126 59 120 70 131 125L186 390L298 394L324 430Z"></path></g><g transform="matrix(.013,0,0,-0.013,42.908,0)"><path d="M300 -147C201 -63 143 98 143 270S200 602 300 686L282 710C136 610 70 450 70 271V270C70 89 136 -72 282 -170L300 -147Z"></path></g><g transform="matrix(.013,0,0,-0.013,47.406,0)"><path d="M383 397C383 424 344 448 299 448C244 448 172 409 132 375C66 319 23 227 23 146C23 42 74 -12 146 -12C208 -12 298 30 359 103L343 124C315 95 248 48 192 48C145 48 111 85 111 163C111 228 129 294 151 330C171 363 201 401 241 401C275 401 302 384 325 356C332 347 339 344 348 348C373 360 383 381 383 397Z"></path></g><g transform="matrix(.013,0,0,-0.013,52.688,0)"><path d="M445 282C445 390 384 448 297 448C266 448 231 437 189 418C96 376 23 279 23 151C23 65 66 -12 169 -12C233 -12 294 18 337 53C411 113 445 201 445 282ZM355 280C355 161 302 62 243 36C231 31 219 30 207 30C147 30 111 78 111 154C111 302 180 380 220 399C231 404 246 407 264 407C311 407 355 367 355 280Z"></path></g><g transform="matrix(.013,0,0,-0.013,58.772,0)"><path d="M275 270C275 450 212 609 64 710L45 686C145 604 203 442 203 270S147 -63 45 -147L64 -170C213 -68 275 89 275 270Z"></path></g></svg></span></td><td class="align_center"><span style="width: 39.8461ptpx;"><svg height="12.7178pt" id="M27" style="vertical-align:-3.42947pt" version="1.1" viewbox="-0.0498162 -9.28833 39.8461 12.7178" width="39.8461pt" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><g transform="matrix(.013,0,0,-0.013,0,0)"><path d="M393 379C402 394 400 411 393 422C384 437 365 448 348 448C301 448 237 372 186 285H182L193 335C210 408 205 448 178 448C150 448 80 402 29 344L45 321C80 355 114 373 122 373C128 373 130 365 124 330C106 228 76 98 50 -5L57 -12C82 -5 112 3 132 6L172 203C196 256 234 304 254 329C275 355 293 367 306 367C318 367 330 360 342 348C347 343 355 343 365 350S386 367 393 379Z"></path></g><rect height="0.3985" width="3.91466" x="6.27108" y="-0.3985"></rect><g transform="matrix(.013,0,0,-0.013,10.186,0)"><path d="M743 375C743 570 607 650 407 650H136L130 622C214 612 220 606 204 526L125 122C110 43 105 36 24 27L17 0H250C382 0 482 23 571 76C680 141 743 248 743 375ZM644 379C644 188 520 36 305 36C277 36 249 38 229 46C205 55 202 71 212 126L293 553C300 588 306 600 317 606C330 613 356 617 390 617C547 617 644 537 644 379Z"></path></g><g transform="matrix(.013,0,0,-0.013,20.144,0)"><path d="M300 -147C201 -63 143 98 143 270S200 602 300 686L282 710C136 610 70 450 70 271V270C70 89 136 -72 282 -170L300 -147Z"></path></g><g transform="matrix(.013,0,0,-0.013,24.642,0)"><path d="M244 607C244 633 228 655 200 655C166 655 146 618 146 594C146 564 166 546 191 546C221 546 244 574 244 607ZM222 91L209 114C184 94 148 66 133 66C127 66 124 73 130 96L201 370C213 416 211 448 191 448C162 448 88 407 29 352L42 328C73 354 104 371 114 371C120 371 119 365 115 345L53 92C32 5 45 -12 68 -12C103 -12 186 50 222 91Z"></path></g><g transform="matrix(.013,0,0,-0.013,27.408,0)"><path d="M570 304C570 398 525 448 414 448C385 448 343 445 312 434L329 511L321 518C297 504 262 482 244 460L233 411C195 397 159 381 128 358L135 332C160 347 189 360 224 373L111 -147C97 -210 84 -218 17 -231L13 -257L254 -247L259 -218L233 -216C183 -212 177 -202 189 -142L218 -1C238 -10 266 -12 283 -12C351 3 429 48 483 105C543 168 570 242 570 304ZM482 289C482 161 380 33 304 33C278 33 248 51 233 69L303 396C326 400 352 403 369 403C428 403 482 380 482 289Z"></path></g><g transform="matrix(.013,0,0,-0.013,35.118,0)"><path d="M275 270C275 450 212 609 64 710L45 686C145 604 203 442 203 270S147 -63 45 -147L64 -170C213 -68 275 89 275 270Z"></path></g></svg></span></td><td class="align_center"> </td></tr><tr><td class="align_left">t_packet_count</td><td class="align_center">t_packet_length</td><td class="align_center">t_duration</td><td class="align_center">t_avg_packet_count</td><td class="align_center">t_avg_packet_length</td></tr><tr><td class="align_left">t_min_packet_length</td><td class="align_center">t_max_packet_length</td><td class="align_center">t_std_packet_length</td><td class="align_center">t_std_packet_count</td><td class="align_center">t_packet_tilt</td></tr><tr><td class="align_left">t_min_packet_count</td><td class="align_center">t<b>_</b>max_packet_count</td><td class="align_center"> </td><td class="align_center"> </td><td class="align_center"> </td></tr><tr class="table-tr"><td colspan="5"><hr class="tbody-hr"/></td></tr></table></td></tr></table>

<div>SSR user detection portrait feature set.</div>

Security and Communication Networks

tab4

Table 4

Table 4: Detecting ShadowsocksR User Based on Intelligence of Cyber Entities 