Identifying censorship circumvention network traffic has become an important task for preventing abuse of those tools. However, traditional flow-based methods have drawbacks in high false positive rate, and they fail to exploit useful hidden features. In this paper, we propose a novel feature extraction method for censorship circumvention activity identification, which extracts features from multi-granularity, and it uses a heuristic-combining approach to make the final decision. Moreover, unlike traditional approaches, which classify on an individual flow or a packet, the proposed method examines on a new granularity. We present an implementation based on the proposed method, and the results are presented to demonstrate the effectiveness of our method. In comparison to the traditional flow-based methods, the proposed strategy has a slightly lower overall accuracy rate than flow-based approaches; however, its average false positive rate is significantly lower than the traditional method. Copyright (C) 2016 John Wiley & Sons, Ltd.
