Detection of Malicious Network Traffic Behavior Using JA3 Fingerprints

Result code in IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F00216224%3A14330%2F22%3A00125938" target="_blank" >RIV/00216224:14330/22:00125938 - isvavai.cz</a>

Result on the web

<a href="https://www.eeict.cz/eeict_download/archiv/sborniky/EEICT_2022_sbornik_2_v2.pdf" target="_blank" >https://www.eeict.cz/eeict_download/archiv/sborniky/EEICT_2022_sbornik_2_v2.pdf</a>

DOI - Digital Object Identifier

—

Result language

angličtina

Original language name

Detection of Malicious Network Traffic Behavior Using JA3 Fingerprints

Original language description

This paper presents a novel approach for classifying spoof network traffic based on JA3 fingerprint clustering. In particular, it concerns the detection of so-called zero-day malware. The proposed method does not work with known JA3 hashes. However, it compares the JA3 fingerprint of captured traffic with JA3 fingerprints of traffic with predefined criteria, such as the use of current cipher suites or protocol, for classification.

Czech name

—

Czech description

—

Type

D - Article in proceedings

CEP classification

—

OECD FORD branch

10201 - Computer sciences, information science, bioinformathics (hardware development to be 2.2, social aspect to be 5.8)

Project

—

Continuities

I - Institucionalni podpora na dlouhodoby koncepcni rozvoj vyzkumne organizace

Publication year

2022

Confidentiality

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Article name in the collection

Proceedings II of the 28th Conference STUDENT EEICT 2022

ISBN

9788021460300

ISSN

—

e-ISSN

—

Number of pages

4

Pages from-to

194-197

Publisher name

Brno University of Technology, Faculty of Electrical Engineering and Communication

Place of publication

Brno

Event location

Brno

Event date

Jan 1, 2022

Type of event by nationality

CST - Celostátní akce

UT code for WoS article

—