Design and Evaluation of HTTP Protocol Parsers for IPFIX Measurement

EURASIP J. on Info. Security

et al. 2016

Self Cite

The encryption of network traffic complicates legitimate network monitoring, traffic analysis, and network forensics. In this paper, we present real-time lightweight identification of HTTPS clients based on network monitoring and SSL/TLS fingerprinting. Our experiment shows that it is possible to estimate the User-Agent of a client in HTTPS communication via the analysis of the SSL/TLS handshake. The fingerprints of SSL/TLS handshakes, including a list of supported cipher suites, differ among clients and correlate to User-Agent values from a HTTP header. We built up a dictionary of SSL/TLS cipher suite lists and HTTP User-Agents and assigned the User-Agents to the observed SSL/TLS connections to identify communicating clients. The dictionary was used to classify live HTTPS network traffic. We were able to retrieve client types from 95.4 % of HTTPS network traffic. Further, we discussed host-based and network-based methods of dictionary retrieval and estimated the quality of the data.

“…The first extension adds a UserAgent (ua) element to a HTTP flow based on the analysis of the HTTP traffic [35]. Only HTTP flows with destination port 80 were considered.…”

Section: Ssl/tls Traffic Measurementmentioning

confidence: 99%

HTTPS traffic analysis and client identification using passive SSL/TLS fingerprinting

Husák

Čermák

EURASIP J. on Info. Security

et al. 2016

Self Cite

“…The first extension adds a User-Agent (ua) element to the flow, based on the analysis of the HTTP traffic [19]:…”

Section: A Ssl/tls Traffic Measurementmentioning

confidence: 99%

Network-Based HTTPS Client Identification Using SSL/TLS Fingerprinting

Husák

Čermák

2015 10th International Conference on Availability, Reliability and Security

et al. 2015

Abstract-The growing share of encrypted network traffic complicates network traffic analysis and network forensics. In this paper, we present real-time lightweight identification of HTTPS clients based on network monitoring and SSL/TLS fingerprinting. Our experiment shows that it is possible to estimate the UserAgent of a client in HTTPS communication via the analysis of the SSL/TLS handshake. The fingerprints of SSL/TLS handshakes, including a list of supported cipher suites, differ among clients and correlate to User-Agent values from a HTTP header. We built up a dictionary of SSL/TLS cipher suite lists and HTTP UserAgents and assigned the User-Agents to the observed SSL/TLS connections to identify communicating clients. We discuss hostbased and network-based methods of dictionary retrieval and estimate the quality of the data. The usability of the proposed method is demonstrated on two case studies of network forensics.

“…Further, we briefly introduce intended approach to the problem. So far, we have developed necessary tools for collecting data and flow information extension, e.g., HTTP monitoring [18], and we have implemented the testbed for the model evaluation [10].…”

Section: Resultsmentioning

confidence: 99%

Enhancing Network Security: Host Trustworthiness Estimation

Monitoring and Securing Virtualized Networks and Services

Čeleda

2014

Self Cite

Abstract. Network connected devices has become inherent part of our lives. These devices have come to be more and more mobile and are target of various malware attacks. An inability to guarantee or check proper security settings of such devices poses a serious risk to network security. In this paper we propose a novel concept of flow based host trustworthiness estimation. The estimated trustworthiness determines a level of the risk to the network security the host posses. This concept enables network operators to identify a potential dangerous host in their network and take an appropriate precautions. Models used for trustworthiness estimation are based on scoring either single events or host characteristics. In order to be able to estimate trustworthiness of a host even in large scale networks, the data used for estimation are reduced only to extended network flows. The research is in its initial phase and will conclude with Ph.D. thesis in three years.