# Towards a Near-Real-Time Protocol Tunneling Detector Based on Machine Learning Techniques +
## 5 Experimental Evaluation
The second malicious dataset, instead, was born by the collaboration between the Bell Canada company's Cyber Threat Intelligence group and the Canadian Institute for Cybersecurity. In this dataset, we only take into account DNS packets that, in their payloads, contain exfiltrations of various types of files and we discard legitimate traffic. Moreover, it is worth mentioning that all the packets contained in [38] have been truncated at capture time to 96 B; this has required a slightly different approach to test these samples that will be discussed \begin{table}
\begin{tabular}{l c} \hline \hline
**Statistics** & **Count [\%]** \\ \hline DNS packets & 30,669 (1.10\%) \\ \hline SMB packets & 65,944 (2.35\%) \\ \hline HTTP packets & 262 (0.01\%) \\ \hline NTP packets & 46 (0.002\%) \\ \hline DHCP packets & 20 (0.001\%) \\ \hline KRB packets & 741 (0.03\%) \\ \hline SFTP packets & 69,158 (2.46\%) \\ \hline Not labeled packets & 61,552 (2.20\%) \\ \hline SSL packets & 2,571,608 (91.84\%) \\ \hline Distinct connections & 51,459 \\ \hline Distinct source machines & 758 \\ \hline Distinct dest. machines & 1566 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Benign test set composition. \begin{table}
\begin{tabular}{l c c c c c} \hline \hline
**Model** & **Kernel** & \(\gamma\) & \(\
u\) & \(t\) & \(C\) \\ \hline DHCP one-class SVM & RBF & 0.7 & 0.03 & 0.77 & – \\ \hline DNS one-class SVM & RBF & 0.7 & 0.03 & 0.77 & – \\ \hline NTP one-class SVM & RBF & 0.03 & 0.1 & 0.92 & – \\ \hline HTTP one-class SVM & RBF & 0.08 & 0.07 & 0.91 & – \\ \hline SMB one-class SVM & RBF & 0.06 & 0.08 & 0.77 & – \\ \hline KRB one-class SVM & RBF & 0.04 & 0.05 & 0.97 & – \\ \hline SFTP one-class SVM & RBF & 0.7 & 0.05 & 0.97 & – \\ \hline SSH one-class SVM & RBF & 0.7 & 0.05 & 0.97 & – \\ \hline SSL one-class SVM & RBF & 0.0001 & 0.0028 & 0.97 & – \\ \hline Compression/encryption detector & RBF & 0.01 & – & – & 100 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Support vector machine hyperparameter settings. later in this Section. Finally, [39] is a single packet capture to test detection and alerting capabilities of Packetbeat, Elastic's network packet analyzer. Malicious packet captures have been injected into the network security platform in order to be processed and analyzed as ordinary traffic. Table 3 reports a summary of the malicious assembled datasets: for each PCAP, we list the number of packets in the capture and which of these packets have been successfully processed by the platform's network analyzer (i.e., those packets whose size is greater or equal than 64 B); in addition, Table 3 depicts the number of connections in the PCAP and the number of them that have been identified as protocol tunneling attacks (i.e., true positives \(TP\)). Finally, the true positive rate \(TPR\) of the proposed detector is reported for each packet capture. Analogously, Table 4 reports the same information contained in Table 3, but with reference to the test set described in Table 1. Being legitimate traffic, the last two columns report the connections mistakenly classified as tunnels (i.e., false positives \(FP\)) and the false positive rate \(FPR\). The results of the evaluation, reported in Tables 3 and 4, show a false positive rate and a true positive rate, respectively, equal to 5.8% and 96.6%. The overall accuracy of the proposed prototype is 97.1%, while the resulting F1-score is 95.6%. We conclude this section by discussing how we slightly modified the proposed approach, used in the other datasets, to be compliant with [38]. Indeed, the DNS packets contained in this dataset have been truncated during traffic acquisition, resulting in byte sequences that do not have the same length. In order to solve this dataset generation problem, we reduced all the DNS packets to a common length of 44 B, discarding the shorter byte sequences and trimming the longer ones.