In the very last years, cybersecurity attacks have increased at an unprecedented pace, becoming ever more sophisticated and costly. Their impact has involved both private/public companies and critical infrastructures. At the same time, due to the COVID-19 pandemic, the security perimeters of many organizations expanded, causing an increase of the attack surface exploitable by threat actors through malware and phishing attacks. Given these factors, it is of primary importance to monitor the security perimeter and the events occurring in the monitored network, according to a tested security strategy of detection and response. In this paper, we present a protocol tunneling detector prototype which inspects, in near real time, a company's network traffic using machine learning techniques. Indeed, tunneling attacks allow malicious actors to maximize the time in which their activity remains undetected. The detector monitors unencrypted network flows and extracts features to detect possible occurring attacks and anomalies, by combining machine learning and deep learning. The proposed module can be embedded in any network security monitoring platform able to provide network flow information along with its metadata. The detection capabilities of the implemented prototype have been tested both on benign and malicious datasets. Results show 97.1% overall accuracy and an F1-score equals to 95.6%.

翻译：近年来，网络安全攻击以前所未有的速度增长，变得日益复杂且代价高昂。其影响波及私营/公共企业及关键基础设施。与此同时，受新冠疫情影响，众多组织的安全边界不断扩大，导致威胁行为体可通过恶意软件和钓鱼攻击利用的攻击面增加。鉴于这些因素，根据经过验证的检测与响应安全策略，监控安全边界及受监测网络中的事件至关重要。本文提出一种基于机器学习技术的协议隧道检测原型系统，可对企业的网络流量进行近实时检测。隧道攻击使恶意行为者能够最大限度地延长其活动未被发现的时间。该检测器通过结合机器学习与深度学习，监测未加密的网络流并提取特征，以检测可能发生的攻击与异常。所提出的模块可嵌入任何能够提供网络流信息及其元数据的网络安全监控平台。原型系统的检测能力已在良性数据集与恶意数据集上得到验证。结果显示，其总体准确率达到97.1%，F1分数为95.6%。