Experience Report: Using JA4+ Fingerprints for Malware Detection in Encrypted Traffic

Result code in IS VaVaI
<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F00216305%3A26230%2F26%3A0189464" target="_blank" >RIV/00216305:26230/26:0189464 - isvavai.cz</a>
Result on the web
<a href="https://www.fit.vut.cz/research/publication/13252/" target="_blank" >https://www.fit.vut.cz/research/publication/13252/</a>
DOI - Digital Object Identifier
<a href="http://dx.doi.org/10.23919/CNSM62983.2024.10814358" target="_blank" >10.23919/CNSM62983.2024.10814358</a>

Result language
angličtina
Original language name
Experience Report: Using JA4+ Fingerprints for Malware Detection in Encrypted Traffic
Original language description
Detection of malware communications is limited due to encryption. Malware control, updates, and distribution are encapsulated in TLS tunnels, making it difficult to distinguish between malicious and benign transmissions. One way, how to detect malware communication, is to analyze the TLS handshake and obtain so-called JA4+ fingerprints. This report analyses the effectiveness of JA4+ fingerprints for malware detection, focusing specifically on the JA4, JA4S and JA4X fingerprints and their accuracy. It examines the process of creating malware fingerprints, explores the uniqueness of these fingerprints across  different malware families and their ability to distinguish between malicious and benign applications. By examining the overlap and uniqueness, the study evaluates the effectiveness of using JA4+ fingerprints to detect malware in encrypted communications.
Czech name
—
Czech description
—

Type
D - Article in proceedings
CEP classification
—
OECD FORD branch
10201 - Computer sciences, information science, bioinformathics (hardware development to be 2.2, social aspect to be 5.8)

Project
<a href="/en/project/VJ02010024" target="_blank" >VJ02010024: Flow-based Encrypted Traffic Analysis</a><br>
Continuities
P - Projekt vyzkumu a vyvoje financovany z verejnych zdroju (s odkazem do CEP)<br>S - Specificky vyzkum na vysokych skolach

Publication year
2024
Confidentiality
S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Article name in the collection
Proceedings of 20th International Conference on Network and Service Management
ISBN
979-8-3315-0515-8
ISSN
—
e-ISSN
—
Number of pages
5
Pages from-to
1-5
Publisher name
Institute of Electrical and Electronics Engineers
Place of publication
Prague
Event location
Praha
Event date
Oct 28, 2024
Type of event by nationality
WRD - Celosvětová akce
UT code for WoS article
001414325200019

Similar results(10)