Indicators of Malicious SSL Connections

Bortolameotti, Riccardo; Andreas, Peter; Everts, Maarten H.; Bolzoni, Damiano

doi:10.1007/978-3-319-25645-0_11

Cited by 4 publications

(6 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Many approaches were proposed to overcome the usage of non-standard port with HTTPS, ranging from behaviour based method to machine learning ones as described below. In spite of that, port 443 is widely used in the large body of literature [5], [10], [16], [29]- [33] to collect and build HTTPS dataset for further experiments.…”

Section: A Port-based Methodsmentioning

confidence: 99%

“…Based on their experiments, they can classify 95% of TLS traffic belonging to Google, Facebook and Kakaotalk with about 90% accuracy for the corresponding services. Authors in [10] use the information in SSL certificate like certificate validity, release dates and the content of subject alternative name as features to detect suspicious TLS traffic.…”

Section: Ssl Certificate Based Methodsmentioning

confidence: 99%

“…Bortolameotti et al [10] used both SNI and SSL certificate information to detect malicious TLS connections by examining (1) Levenshtein distance between the SNI and top 100 most visited websites; (2) the structure of the server-name string in SNI; (3) the format of the server-name string, which is a DNS hostname format. In [43], authors evaluate the reliability of identifying HTTPS based on SNI.…”

Section: Protocol-structure Based Methodsmentioning

confidence: 99%

“…While from the security side, HTTPS makes security monitoring methods unable to understand the traffic and to identify anomalies or malicious activities that can be hidden in encrypted connections [9]. Bortolameotti et al [10] have proposed indicators for malicious HTTPS connections that can be used in Data Exfiltration scenario, where a compromised enterprise's machine transfers sensitive information to an external server controlled by an attacker over a HTTPS channel to circumvent the security monitoring techniques. Therefore, there is a high demand for solutions able to analyse HTTPS traffic.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

A Survey of HTTPS Traffic and Services Identification Approaches

Shbair,

Cholez,

Francois

et al. 2020

Preprint

View full text Add to dashboard Cite

HTTPS is quickly rising alongside the need of Internet users to benefit from security and privacy when accessing the Web, and it becomes the predominant application protocol on the Internet. This migration towards a secure Web using HTTPS comes with important challenges related to the management of HTTPS traffic to guarantee basic network properties such as security, QoS, reliability, etc. But encryption undermines the effectiveness of standard monitoring techniques and makes it difficult for ISPs and network administrators to properly identify and manage the services behind HTTPS traffic. This survey details the techniques used to monitor HTTPS traffic, from the most basic level of protocol identification (TLS, HTTPS), to the finest identification of precise services. We show that protocol identification is well mastered while more precise levels keep being challenging despite recent advances. We also describe practical solutions that lead us to discuss the trade-off between security and privacy and the research directions to guarantee both of them.

show abstract

Section: A Port-based Methodsmentioning

confidence: 99%

Section: Ssl Certificate Based Methodsmentioning

confidence: 99%

Section: Protocol-structure Based Methodsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

A Survey of HTTPS Traffic and Services Identification Approaches

Shbair,

Cholez,

Francois

et al. 2020

Preprint

View full text Add to dashboard Cite

show abstract

“…A group of indicators of malicious connections for SSL was proposed by Riccardo Bortolameotti et al [45], which utilized unencrypted part of SSL. With the help of these indicators, authors found various malicious connections and vulnerable SSL connections to Man-inthe-Middle attacks (MITM).…”

Section: Botnetmentioning

confidence: 99%