Practical VPN Fingerprinting using Coarse Inference of Field Specifications in Data Channels

Abstract

VPN fingerprinting techniques are essential for network administrators to mitigate security threats arising from unauthorized or harmful VPN usage. Existing methods often rely on complex, protocol-specific signatures or computationally expensive AI models, limiting their practical applicability. In this paper, we introduce VPNSpotter, a practical VPN fingerprinting technique that infers coarse-grained field specifications from consistent data channel packets. VPNSpotter employs heuristic filtering to discard control channel packets and inconsistent packets caused by retransmission, segmentation, and aggregation. It then infers coarse-grained field specifications in a column-wise manner, categorizing fields into five predefined types. Evaluations on diverse VPN protocols—including mainstream, proprietary, and obfuscated variants—demonstrate that VPNSpotter accurately and efficiently identifies VPN traffic, outperforming prior signature-based and AI-based approaches.