A survey of methods for encrypted traffic classification and analysis

Abstract

Summary With the widespread use of encrypted data transport, network traffic encryption is becoming a standard nowadays. This presents a challenge for traffic measurement, especially for analysis and anomaly detection methods, which are dependent on the type of network traffic. In this paper, we survey existing approaches for classification and analysis of encrypted traffic. First, we describe the most widespread encryption protocols used throughout the Internet. We show that the initiation of an encrypted connection and the protocol structure give away much information for encrypted traffic classification and analysis. Then, we survey payload and feature‐based classification methods for encrypted traffic and categorize them using an established taxonomy. The advantage of some of described classification methods is the ability to recognize the encrypted application protocol in addition to the encryption protocol. Finally, we make a comprehensive comparison of the surveyed feature‐based classification methods and present their weaknesses and strengths. Copyright © 2015 John Wiley & Sons, Ltd.

HTTPS traffic analysis and client identification using passive SSL/TLS fingerprinting

“…We have to use methods from a survey by Velan et al [2] as the basis and a real network data to identify these options. Then, we have to find which of the options are varying the most and if the variability of these options indicates different traffic patterns, e.g., different communicating partners or type of traffic.…”

Erratum

“…In the article listed below , there was an error with the reference citations in Table 4, column 1. The corrected reference citations are given in the revised Table 4 below.…”

Browser Identification Based on Encrypted Traffic

“…Another study of SSL/TLS traffic was raised by Holz and partners in 2011 [3] , who also focus on certificate properties. Roni and Langberg classified encrypted network flows by their application type [4] .Velan and Milan found that the initiation of an encrypted connection and the protocol structure give away much information about traffic clissificaion [5] .The SSL/TLS protocol and its applications were analyzed by Qualys SSL Lab [6] , they proposed the idea of HTTP client fingerprinting using the information of SSL/TLS handshake. Martin Husák and colleagues gave a way to estimate User-Agent of a client in HTTPS communication through the fingerprint of initial SSL/TLS handshake in 2015 [7] .However, due to the fuzziness of the fingerprint, the identification of browsers was not accurate.Salusky and Thomas disclosed for fingerprinting and identifying client applications based on the analysis of client requests in an HTTP-based communication [8] .For the algorithm of traffic identification, Alshammari and his colleagues assessed the robustness of machine learning for classifying encrypted traffic [9] .…”