Event-Flow Correlation for Anomaly Detection in HTTP/3 Web Traffic
The result's identifiers
Result code in IS VaVaI
<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F00216224%3A14610%2F23%3A00130307" target="_blank" >RIV/00216224:14610/23:00130307 - isvavai.cz</a>
Result on the web
<a href="http://dx.doi.org/10.1109/NOMS56928.2023.10154211" target="_blank" >http://dx.doi.org/10.1109/NOMS56928.2023.10154211</a>
DOI - Digital Object Identifier
<a href="http://dx.doi.org/10.1109/NOMS56928.2023.10154211" target="_blank" >10.1109/NOMS56928.2023.10154211</a>
Alternative languages
Result language
angličtina
Original language name
Event-Flow Correlation for Anomaly Detection in HTTP/3 Web Traffic
Original language description
The new HTTP/3 protocol for web traffic was recently released, superseding the widely used HTTP/2. It now supports exclusively encrypted transmissions and brings a lot of other changes. Many of these changes promote user privacy but hinder security monitoring of network traffic. In the past, the direct correlation of events and flows generated by the HTTP/2 web traffic enriched the encrypted network flows with the content from the web server's event log. In this paper, we modify the event-flow correlation method for the HTTP/3 protocol. Then, we deploy and evaluate the correlation method on a real traffic dataset. We compare the results of the correlation with the results for HTTP/2 and discuss the differences in the correlation of the new protocol compared to the original one. The results show that event-flow correlation can still enrich HTTP/3 network flows, albeit it introduces new challenges to cope with.
Czech name
—
Czech description
—
Classification
Type
D - Article in proceedings
CEP classification
—
OECD FORD branch
10201 - Computer sciences, information science, bioinformathics (hardware development to be 2.2, social aspect to be 5.8)
Result continuities
Project
<a href="/en/project/EF16_019%2F0000822" target="_blank" >EF16_019/0000822: CyberSecurity, CyberCrime and Critical Information Infrastructures Center of Excellence</a><br>
Continuities
P - Projekt vyzkumu a vyvoje financovany z verejnych zdroju (s odkazem do CEP)<br>S - Specificky vyzkum na vysokych skolach
Others
Publication year
2023
Confidentiality
S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů
Data specific for result type
Article name in the collection
2023 IEEE/IFIP Network Operations and Management Symposium (NOMS 2023)
ISBN
9781665477161
ISSN
—
e-ISSN
—
Number of pages
6
Pages from-to
1-6
Publisher name
IEEE Xplore Digital Library
Place of publication
Miami, Florida, USA
Event location
Miami, Florida, USA
Event date
Jan 1, 2023
Type of event by nationality
WRD - Celosvětová akce
UT code for WoS article
—