Fast Packet Inspection for End-To-End Encryption

Abstract

With the recent development and popularization of various network technologies, communicating with people at any time, and from any location, using high-speed internet, has become easily accessible. At the same time, eavesdropping, data interception, personal data leakage, and distribution of malware during the information transfer process have become easier than ever. Recently, to respond to such threats, end-to-end encryption (E2EE) technology has been widely implemented in commercial network services as a popular information security system. However, with the use of E2EE technology, it is difficult to check whether an encrypted packet is malicious in an information security system. A number of studies have been previously conducted on deep packet inspection (DPI) through trustable information security systems. However, the E2EE is not maintained when conducting a DPI, which requires a long inspection time. Thus, in this study, a fast packet inspection (FPI) and its frame structure for quickly detecting known malware patterns while maintaining E2EE are proposed. Based on the simulation results, the proposed FPI allows for inspecting packets approximately 14.4 and 5.3 times faster, respectively, when the inspection coverage is 20% and 100%, as compared with a DPI method under a simulation environment in which the payload length is set to 640 bytes.

SoK: Content Moderation for End-to-End Encryption

“…Such an approach would allow a service to check whether a message contained any particular piece of media (say, a divisive political meme) by hashing the media and comparing the hash of the message. The service provider could essentially monitor user content, well beyond class C. We believe these constructions so completely defeat E2EE guarantees that they cannot defensibly be considered compatible, and we emphatically reject these proposed directions from both researchers and governments (e.g., [5,200,341]).…”

“…The service provider could essentially monitor user content, well beyond class 𝐶. We believe these constructions so completely defeat E2EE guarantees that they cannot defensibly be considered compatible, and we emphatically reject these proposed directions from both researchers and governments (e.g., [5,200,341]).…”

Anomaly Detection in Encrypted Internet Traffic Using Hybrid Deep Learning

“…Production devices in service provider and user environments employ traffic classification for attack detection that would typically require significant computing resources to decrypt and (re)encrypt data in real-time affecting the network throughput, delay, and overall user experience. e costs of associated techniques such as deep packet inspection (DPI) are also substantial in terms of equipment and resources that these are not considered readily adoptable [27,28]. e encryption and decryption of network traffic is not only resource intensive but also a challenging task for network managers in adequately preserving the privacy of end-users.…”

Malicious Traffic Compression and Classification Technique for Secure Internet of Things

“…Furthermore, IoT devices are used in various industrial fields such as agriculture, medical care, and manufacturing, and real-time management and automation have improved the efficiency of the related processes [2]. In addition, online services have become common because of COVID-19, and there has been rapid growth in areas such as remote working and remote learning [3]. Consequently, the scale of damage caused by the leakage of personal information and industrial secrets is increasing, which has highlighted the importance of endpoint security for personal computers (PCs) and smartphones [4].…”