OTTer: A Scalable High-Resolution Encrypted Traffic Identification Engine

Papadogiannaki, Eva; Halevidis, Constantinos; Akritidis, Periklis; Koromilas, Lazaros

doi:10.1007/978-3-030-00470-5_15

Cited by 24 publications

(15 citation statements)

References 34 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…It works by constructing an automaton that executes transitions for each 8-bit ASCII character of the input text. Since we aim to adapt the algorithm to match signatures that describe sequences of packet payload sizes, we replace the 8-bit characters with 16-bit values that represent packet sizes, similar to [ 6 ]. The algorithm builds a finite state machine, resembling a trie with added “failure” links between the trie nodes.…”

Section: Intrusion Detection Enginementioning

confidence: 99%

“…Conti et al [ 5 , 54 ] and Taylor et al [ 24 , 55 ] propose systems that aim to identify user actions and smartphone apps by analyzing Android encrypted network traffic. OTTer [ 6 ] is a scalable engine that identifies fine-grained user actions in OTT mobile applications even in encrypted network traffic. Moreover, Rosner et al [ 7 ] present a black-box approach for detecting and quantifying side-channel information leaks in TLS-encrypted network traffic.…”

Section: Related Workmentioning

confidence: 99%

“…More specifically, such works focus on investigating which network related characteristics reveal the nature of the network traffic. As it occurs, we can divide the resulted network-related characteristics that make traffic classification feasible—even in encrypted networks—into three groups: (i) time-related, (ii) packet-related, and (iii) statistical characteristics [ 5 , 6 , 7 ]. Based on the outcomes of those works, we build signatures from the most descriptive and revealing packet metadata categories; the sequence of packet payload lengths (ordered by the time the arrive at the network interface) and the packet direction.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Acceleration of Intrusion Detection in Encrypted Network Traffic Using Heterogeneous Hardware

Papadogiannaki

Ioannidis

2021

Sensors

Self Cite

View full text Add to dashboard Cite

More than 75% of Internet traffic is now encrypted, and this percentage is constantly increasing. The majority of communications are secured using common encryption protocols such as SSL/TLS and IPsec to ensure security and protect the privacy of Internet users. However, encryption can be exploited to hide malicious activities, camouflaged into normal network traffic. Traditionally, network traffic inspection is based on techniques like deep packet inspection (DPI). Common applications for DPI include but are not limited to firewalls, intrusion detection and prevention systems, L7 filtering, and packet forwarding. With the widespread adoption of network encryption though, DPI tools that rely on packet payload content are becoming less effective, demanding the development of more sophisticated techniques in order to adapt to current network encryption trends. In this work, we present HeaderHunter, a fast signature-based intrusion detection system even for encrypted network traffic. We generate signatures using only network packet metadata extracted from packet headers. In addition, we examine the processing acceleration of the intrusion detection engine using different heterogeneous hardware architectures.

show abstract

Section: Intrusion Detection Enginementioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Acceleration of Intrusion Detection in Encrypted Network Traffic Using Heterogeneous Hardware

Papadogiannaki

Ioannidis

2021

Sensors

Self Cite

View full text Add to dashboard Cite

show abstract

“…A study conducted by viewing sequence of packet size without payload (Papadogiannaki et al, 2018) showed that the sequence of packets could reflect the unique characteristics of service/protocol.…”

Section: Related Workmentioning

confidence: 99%

CNN-based anomaly detection for packet payloads of industrial control system

Song

Paul

Yun

et al. 2021

IJSNET

View full text Add to dashboard Cite

Industrial control systems (ICSs) are more vulnerable to cyber threats owing to their network connectivity. The intrusion detection system (IDS) has been deployed to detect sophisticated cyber-attack but the existing IDS uses the packet header information for traffic flow detection. IDS is inefficient to detect packet deformation; therefore, we propose the adoption of packet payload in IDS to respond to a variety of attacks and high performance. Our proposed model detects packet modification and traffic flow by inspecting each packet and sequence of packets. For evaluation, cross verification is conducted to increase the reliability of the statistics.

show abstract

“…Conti et al proposed a method for identifying user actions in Android applications based on information from TCP/IP packet metadata in encrypted traffic [64,65]. Papadogiannaki et al proposed a pattern language for describing IP packet sequences and use it for fine-grained identification of application events, also in encrypted traffic [66]. Traffic classification was also performed using first 5 packets of a TCP connection [67], or counting received packets and bytes [68].…”

Section: Related Workmentioning

confidence: 99%

Detection of illicit cryptomining using network metadata

Russo

Šrndić

Laskov

2021

Preprint

View full text Add to dashboard Cite

Illicit cryptocurrency mining has become one of the prevalent methods for monetization of computer security incidents. In this attack, victims' computing resources are abused to mine cryptocurrency for the benefit of attackers. The most popular illicitly mined digital coin is Monero as it provides strong anonymity and is efficiently mined on CPUs. Illicit mining crucially relies on communication between compromised systems and remote mining pools using the de facto standard protocol Stratum. While prior research primarily focused on endpoint-based detection of in-browser mining, in this paper we address network-based detection of cryptomining malware in general. We propose XMR-Ray, a machine learning detector using novel features based on reconstructing the Stratum protocol from raw NetFlow records. Our detector is trained offline using only mining traffic and does not require privacy-sensitive normal network traffic, which facilitates its adoption and integration. In our experiments, XMR-Ray attained 98.94% detection rate at 0.05% false alarm rate, outperforming the closest competitor. Our evaluation furthermore demonstrates that it reliably detects previously unseen mining pools, is robust against common obfuscation techniques such as encryption and proxies, and is applicable to mining in the browser or by compiled binaries. Finally, by deploying our detector in a large university network, we show its effectiveness in protecting real-world systems.

show abstract

OTTer: A Scalable High-Resolution Encrypted Traffic Identification Engine

Cited by 24 publications

References 34 publications

Acceleration of Intrusion Detection in Encrypted Network Traffic Using Heterogeneous Hardware

Acceleration of Intrusion Detection in Encrypted Network Traffic Using Heterogeneous Hardware

CNN-based anomaly detection for packet payloads of industrial control system

Detection of illicit cryptomining using network metadata

Contact Info

Product

Resources

About