Early Identification of Services in HTTPS Traffic

Authors: Wazen M. Shbair, Thibault Cholez, Jerome Francois, Isabelle Chrisment
Published: 2020-08-19

Source: https://arxiv.org/abs/2008.08350

PDF: https://arxiv.org/pdf/2008.08350

Labels Predicted by AI

性能評価指標 通信効率 機械学習手法

Please note that these labels were automatically added by AI. Therefore, they may not be entirely accurate.
For more details, please see the About the Literature Database page.

Abstract

Traffic monitoring is essential for network management tasks that ensure security and QoS. However, the continuous increase of HTTPS traffic undermines the effectiveness of current service-level monitoring that can only rely on unreliable parameters from the TLS handshake (X.509 certificate, SNI) or must decrypt the traffic. We propose a new machine learning-based method to identify HTTPS services without decryption. By extracting statistical features on TLS handshake packets and on a small number of application data packets, we can identify HTTPS services very early in the session. Extensive experiments performed over a significant and open dataset show that our method offers a good accuracy and a prototype implementation confirms that the early identification of HTTPS services is satisfied.