Towards identification of network applications in encrypted traffic

Result code in IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F00216305%3A26230%2F26%3A0198668" target="_blank" >RIV/00216305:26230/26:0198668 - isvavai.cz</a>

Result on the web

<a href="https://link.springer.com/article/10.1007/s12243-025-01114-z" target="_blank" >https://link.springer.com/article/10.1007/s12243-025-01114-z</a>

DOI - Digital Object Identifier

<a href="http://dx.doi.org/10.1007/s12243-025-01114-z" target="_blank" >10.1007/s12243-025-01114-z</a>

Result language

angličtina

Original language name

Towards identification of network applications in encrypted traffic

Original language description

Network traffic monitoring for security threat detection and network performance management is challenging due to the encryption of most communications. This article addresses the problem of identifying network applications associated with Transport Layer Security (TLS) connections. The evaluation of three primary approaches to classifying TLS-encrypted traffic was carried out: fingerprinting methods, Server Name Indication (SNI)-based identification, and machine learning-based classifiers. Each method has its own strengths and limitations: fingerprinting relies on a regularly updated database of known hashes, SNI is vulnerable to obfuscation or missing information, and AI techniques such as machine learning require sufficient labeled training data. A comparison of these methods highlights the challenges of identifying individual applications, as the TLS properties are significantly shared between applications. Nevertheless, even when identifying a collection of candidate applications, a valuable insight into network monitoring can be gained, and this can be achieved with high accuracy by all the methods considered. To facilitate further research in this area, a novel publicly available dataset of TLS communications has been created, with the communications annotated for popular desktop and mobile applications. Furthermore, the results of three different approaches to refine TLS traffic classification based on a combination of basic classifiers and context are presented. Finally, practical use cases are proposed, and future research directions are identified to further improve application identification methods.

Czech name

—

Czech description

—

Type

J_imp - Article in a specialist periodical, which is included in the Web of Science database

CEP classification

—

OECD FORD branch

10201 - Computer sciences, information science, bioinformathics (hardware development to be 2.2, social aspect to be 5.8)

Project

<a href="/en/project/TM05000014" target="_blank" >TM05000014: Privacy-respecting Explainable Assessment and Collection of Threats</a><br>

Continuities

P - Projekt vyzkumu a vyvoje financovany z verejnych zdroju (s odkazem do CEP)

Publication year

2025

Confidentiality

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Name of the periodical

Annals of Telecommunications

ISSN

0003-4347

e-ISSN

1958-9395

Volume of the periodical

2025

Issue of the periodical within the volume

9

Country of publishing house

FR - FRANCE

Number of pages

18

Pages from-to

1015-1032

UT code for WoS article

001561960900001

EID of the result in the Scopus database

2-s2.0-105015098800