Towards Identification of Network Applications in Encrypted Traffic

Kód výsledku v IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F00216305%3A26230%2F26%3A0193364" target="_blank" >RIV/00216305:26230/26:0193364 - isvavai.cz</a>

Výsledek na webu

<a href="https://www.fit.vut.cz/research/publication/13289/" target="_blank" >https://www.fit.vut.cz/research/publication/13289/</a>

DOI - Digital Object Identifier

<a href="http://dx.doi.org/10.1109/CSNet64211.2024.10851738" target="_blank" >10.1109/CSNet64211.2024.10851738</a>

Jazyk výsledku

angličtina

Název v původním jazyce

Towards Identification of Network Applications in Encrypted Traffic

Popis výsledku v původním jazyce

Network traffic monitoring for security threat detection and network performance management is challenging because most communications are protected by encryption. This paper addresses the problem of identifying applications associated with Transport Layer Security (TLS) network connections. We evaluate three primary approaches to classifying TLS traffic: fingerprinting methods, SNI-based identification, and machine learning-based classifiers. Each method has strengths and limitations: fingerprinting relies on a regularly updated database of known hashes, SNI is vulnerable to obfuscation or missing information, and an AI technique such as machine learning requires sufficient labelled training data. The comparison of these methods that we present highlights the challenges of identifying individual applications, as TLS properties are significantly shared across applications. The simpler task of identifying a collection of candidate applications still provides valuable insights for network monitoring and can be achieved with high accuracy by all methods considered. Finally, we suggest practical use cases and identify future research directions to further improve application identification methods.

Název v anglickém jazyce

Towards Identification of Network Applications in Encrypted Traffic

Popis výsledku anglicky

Network traffic monitoring for security threat detection and network performance management is challenging because most communications are protected by encryption. This paper addresses the problem of identifying applications associated with Transport Layer Security (TLS) network connections. We evaluate three primary approaches to classifying TLS traffic: fingerprinting methods, SNI-based identification, and machine learning-based classifiers. Each method has strengths and limitations: fingerprinting relies on a regularly updated database of known hashes, SNI is vulnerable to obfuscation or missing information, and an AI technique such as machine learning requires sufficient labelled training data. The comparison of these methods that we present highlights the challenges of identifying individual applications, as TLS properties are significantly shared across applications. The simpler task of identifying a collection of candidate applications still provides valuable insights for network monitoring and can be achieved with high accuracy by all methods considered. Finally, we suggest practical use cases and identify future research directions to further improve application identification methods.

Druh

D - Stať ve sborníku

CEP obor

—

OECD FORD obor

10201 - Computer sciences, information science, bioinformathics (hardware development to be 2.2, social aspect to be 5.8)

Projekt

<a href="/cs/project/VJ02010024" target="_blank" >VJ02010024: Analýza šifrovaného provozu pomocí síťových toků</a><br>

Návaznosti

P - Projekt vyzkumu a vyvoje financovany z verejnych zdroju (s odkazem do CEP)<br>S - Specificky vyzkum na vysokych skolach

Rok uplatnění

2024

Kód důvěrnosti údajů

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Název statě ve sborníku

The Proceedings of the 8th Cyber Security in Networking Conference (CSNet 2024)

ISBN

979-8-3315-3411-0

ISSN

—

e-ISSN

—

Počet stran výsledku

9

Strana od-do

213-221

Název nakladatele

IEEE Communications Society

Místo vydání

Paris

Místo konání akce

Paris

Datum konání akce

4. 12. 2024

Typ akce podle státní příslušnosti

WRD - Celosvětová akce

Kód UT WoS článku

001445789900034