Towards Identification of Network Applications in Encrypted Traffic
The result's identifiers
Result code in IS VaVaI
<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F00216305%3A26230%2F26%3A0193364" target="_blank" >RIV/00216305:26230/26:0193364 - isvavai.cz</a>
Result on the web
<a href="https://www.fit.vut.cz/research/publication/13289/" target="_blank" >https://www.fit.vut.cz/research/publication/13289/</a>
DOI - Digital Object Identifier
<a href="http://dx.doi.org/10.1109/CSNet64211.2024.10851738" target="_blank" >10.1109/CSNet64211.2024.10851738</a>
Alternative languages
Result language
angličtina
Original language name
Towards Identification of Network Applications in Encrypted Traffic
Original language description
Network traffic monitoring for security threat detection and network performance management is challenging because most communications are protected by encryption. This paper addresses the problem of identifying applications associated with Transport Layer Security (TLS) network connections. We evaluate three primary approaches to classifying TLS traffic: fingerprinting methods, SNI-based identification, and machine learning-based classifiers. Each method has strengths and limitations: fingerprinting relies on a regularly updated database of known hashes, SNI is vulnerable to obfuscation or missing information, and an AI technique such as machine learning requires sufficient labelled training data. The comparison of these methods that we present highlights the challenges of identifying individual applications, as TLS properties are significantly shared across applications. The simpler task of identifying a collection of candidate applications still provides valuable insights for network monitoring and can be achieved with high accuracy by all methods considered. Finally, we suggest practical use cases and identify future research directions to further improve application identification methods.
Czech name
—
Czech description
—
Classification
Type
D - Article in proceedings
CEP classification
—
OECD FORD branch
10201 - Computer sciences, information science, bioinformathics (hardware development to be 2.2, social aspect to be 5.8)
Result continuities
Project
<a href="/en/project/VJ02010024" target="_blank" >VJ02010024: Flow-based Encrypted Traffic Analysis</a><br>
Continuities
P - Projekt vyzkumu a vyvoje financovany z verejnych zdroju (s odkazem do CEP)<br>S - Specificky vyzkum na vysokych skolach
Others
Publication year
2024
Confidentiality
S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů
Data specific for result type
Article name in the collection
The Proceedings of the 8th Cyber Security in Networking Conference (CSNet 2024)
ISBN
979-8-3315-3411-0
ISSN
—
e-ISSN
—
Number of pages
9
Pages from-to
213-221
Publisher name
IEEE Communications Society
Place of publication
Paris
Event location
Paris
Event date
Dec 4, 2024
Type of event by nationality
WRD - Celosvětová akce
UT code for WoS article
001445789900034