Event-Flow Correlation for Anomaly Detection in HTTP/3 Web Traffic

Kód výsledku v IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F00216224%3A14610%2F23%3A00130307" target="_blank" >RIV/00216224:14610/23:00130307 - isvavai.cz</a>

Výsledek na webu

<a href="http://dx.doi.org/10.1109/NOMS56928.2023.10154211" target="_blank" >http://dx.doi.org/10.1109/NOMS56928.2023.10154211</a>

DOI - Digital Object Identifier

<a href="http://dx.doi.org/10.1109/NOMS56928.2023.10154211" target="_blank" >10.1109/NOMS56928.2023.10154211</a>

Jazyk výsledku

angličtina

Název v původním jazyce

Event-Flow Correlation for Anomaly Detection in HTTP/3 Web Traffic

Popis výsledku v původním jazyce

The new HTTP/3 protocol for web traffic was recently released, superseding the widely used HTTP/2. It now supports exclusively encrypted transmissions and brings a lot of other changes. Many of these changes promote user privacy but hinder security monitoring of network traffic. In the past, the direct correlation of events and flows generated by the HTTP/2 web traffic enriched the encrypted network flows with the content from the web server's event log. In this paper, we modify the event-flow correlation method for the HTTP/3 protocol. Then, we deploy and evaluate the correlation method on a real traffic dataset. We compare the results of the correlation with the results for HTTP/2 and discuss the differences in the correlation of the new protocol compared to the original one. The results show that event-flow correlation can still enrich HTTP/3 network flows, albeit it introduces new challenges to cope with.

Název v anglickém jazyce

Event-Flow Correlation for Anomaly Detection in HTTP/3 Web Traffic

Popis výsledku anglicky

The new HTTP/3 protocol for web traffic was recently released, superseding the widely used HTTP/2. It now supports exclusively encrypted transmissions and brings a lot of other changes. Many of these changes promote user privacy but hinder security monitoring of network traffic. In the past, the direct correlation of events and flows generated by the HTTP/2 web traffic enriched the encrypted network flows with the content from the web server's event log. In this paper, we modify the event-flow correlation method for the HTTP/3 protocol. Then, we deploy and evaluate the correlation method on a real traffic dataset. We compare the results of the correlation with the results for HTTP/2 and discuss the differences in the correlation of the new protocol compared to the original one. The results show that event-flow correlation can still enrich HTTP/3 network flows, albeit it introduces new challenges to cope with.

Druh

D - Stať ve sborníku

CEP obor

—

OECD FORD obor

10201 - Computer sciences, information science, bioinformathics (hardware development to be 2.2, social aspect to be 5.8)

Projekt

<a href="/cs/project/EF16_019%2F0000822" target="_blank" >EF16_019/0000822: Centrum excelence pro kyberkriminalitu, kyberbezpečnost a ochranu kritických informačních infrastruktur</a><br>

Návaznosti

P - Projekt vyzkumu a vyvoje financovany z verejnych zdroju (s odkazem do CEP)<br>S - Specificky vyzkum na vysokych skolach

Rok uplatnění

2023

Kód důvěrnosti údajů

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Název statě ve sborníku

2023 IEEE/IFIP Network Operations and Management Symposium (NOMS 2023)

ISBN

9781665477161

ISSN

—

e-ISSN

—

Počet stran výsledku

6

Strana od-do

1-6

Název nakladatele

IEEE Xplore Digital Library

Místo vydání

Miami, Florida, USA

Místo konání akce

Miami, Florida, USA

Datum konání akce

1. 1. 2023

Typ akce podle státní příslušnosti

WRD - Celosvětová akce

Kód UT WoS článku

—