Network Intrusion Detection in Encrypted Traffic

Papadogiannaki, Eva; Tsirantonakis, Giorgos; Ioannidis, Sotiris

doi:10.1109/dsc54232.2022.9888942

Cited by 6 publications

(1 citation statement)

References 31 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Machine learning is widely used to test the feasibility of encrypted traffic analysis, using network packet metadata and not payload contents [14], [15], [31]- [36]. Other works focus on real-time traffic inspection based on network metadata patterns [17], [37]- [39]. Other works that are able to process encrypted traffic perform searchable encryption, enabling middleboxes to gain insight from the exchanged traffic nature [40]- [42].…”

Section: B Tls Server Configurationsmentioning

confidence: 99%

Pump Up the JARM: Studying the Evolution of Botnets Using Active TLS Fingerprinting

Papadogiannaki,

Ioannidis

2023

2023 IEEE Symposium on Computers and Communications (ISCC)

Self Cite

View full text Add to dashboard Cite

The growing adoption of network encryption protocols, like TLS, has altered the scene of monitoring network traffic. With the advent and rapid increase in network encryption mechanisms, typical deep packet inspection systems that monitor network packet payload contents are gradually becoming obsolete, while in the meantime, adversaries abuse the utilization of the TLS protocol to bypass them. In this paper, aiming to understand the botnet ecosystem in the wild, we contact IP addresses known to participate in malicious activities using the JARM tool for active probing. Based on packets acquired from TLS handshakes, server fingerprints are constructed during a time period of 7 months. The fingerprints express servers' responses to a sequence of several ''TLS Client Hello'' messages with different TLS attributes and we investigate if it is feasible to detect suspicious servers and re-identify other similar within blocklists with no prior knowledge of their activities. Based on our study, we can see that fingerprints originating from suspicious servers are repetitive among similarly configured servers. We show that it is important to update fingerprints often or follow a more effective fingerprinting approach, since the overlapping ratio with legitimate servers rises over time.

show abstract

Section: B Tls Server Configurationsmentioning

confidence: 99%

Pump Up the JARM: Studying the Evolution of Botnets Using Active TLS Fingerprinting

Papadogiannaki,

Ioannidis

2023

2023 IEEE Symposium on Computers and Communications (ISCC)

Self Cite

View full text Add to dashboard Cite

show abstract

Deep Learning Classification for Encrypted Botnet Traffic: Optimising Model Performance and Resource Utilisation

Carr,

Chavula

2024

Communications in Computer and Information Science

View full text Add to dashboard Cite

MADESANT: malware detection and severity analysis in industrial environments

Jayalaxmi,

Chakraborty,

Saha

et al. 2024

Cluster Comput

View full text Add to dashboard Cite

Malware remains a persistent threat to industrial operations, causing disruptions and financial losses. Traditional malware detection approaches struggle with the increasing complexity of false positives and negatives. However, existing Intrusion Detection Systems (IDSs) often lack the capability to assess the severity of detected malware, crucial for effective threat mitigation. This paper presents a novel model, MAlware DEtection and Severity Analysis for eNcrypted Traffic (MADESANT), designed to detect and analyze malware severity in encrypted traffic data. MADESANT combines Deep Learning (DL)-based intrusion detection with Machine Learning (ML)-based severity analysis, specifically customized for the minutiae of IoT systems and assets. Notably, MADESANT introduces a cascading model integrating a Cascading Forward Back Propagation Neural Network (CFBPNN) with the J48 tree to systematically assess risk factors in network traffic. Our assessment, conducted on diverse encrypted datasets including UNSW-NB15, IoT23, and XIIoTID, highlights the remarkable efficacy of MADESANT. Impressively, it achieves a flawless 0% false positive rate in detecting binary attack instances, surpassing benchmarks set by conventional models. Additionally, MADESANT excels in accurately estimate malware severity, providing invaluable insights into the factors contributing to the risk. To further validate its efficiency, we compared MADESANT against prevalent Neural Network models like FeedForward and Recurrent Neural Networks, with MADESANT emerging as the superior choice. The experimentation encompasses both the entire dataset and subsets generated through meticulous risk factor analysis. These results underscore MADESANT’s prowess in not only identifying malware but also in evaluating its potential impact, signifying a significant leap forward in industrial cybersecurity.

show abstract

Network Intrusion Detection in Encrypted Traffic

Cited by 6 publications

References 31 publications

Pump Up the JARM: Studying the Evolution of Botnets Using Active TLS Fingerprinting

Pump Up the JARM: Studying the Evolution of Botnets Using Active TLS Fingerprinting

Deep Learning Classification for Encrypted Botnet Traffic: Optimising Model Performance and Resource Utilisation

MADESANT: malware detection and severity analysis in industrial environments

Contact Info

Product

Resources

About