Transparent and Service-Agnostic Monitoring of Encrypted Web Traffic

Abstract

Nowadays, most of web services are accessed through HTTPS. While preserving user privacy is important, it is also mandatory to monitor and detect specific users' actions, for instance, according to a security policy. This paper presents a solution to monitor HTTP/2 traffic over TLS. It highly differs from HTTP/1.1 over TLS traffic what makes existing monitoring techniques obsolete. Our solution, H2Classifier, aims at detecting if a user performs an action that has been previously defined over a monitored web service, but without using any decryption. It is thus only based on passive traffic analysis and relies on random forest classifier. A challenge is to extract representative values of the loaded content associated to a web page, which is actually customized based on the user action. Extensive evaluations with five top used web services demonstrate the viability of our technique with an accuracy between 94% and 99%.

Encrypted HTTP/2 Traffic Monitoring: Standing the Test of Time and Space

“…This paper thus extends our previous work [1] by investigating the two questions mentioned above. Besides, as we consider the de facto standard for web nowadays, our reported results aim at evaluating the viability of our technique on-theshelf, i.e.…”

“…HTTPS is nowadays the default protocol for 59.4% 1 of websites in the Internet mostly due to the users' expectation regarding privacy and security after the scandals revealed over the last decade and the increase of data leakage and identity theft impacting individuals.…”

“…Thanks to large deployment of HTTPS and under the guise of privacy, malicious users can also unfortunately hide abnormal or even illegal use of a service. In our prior work [1], we have demonstrated that machine learning algorithms can 1 https://w3techs.com/technologies/details/ce-httpsdefault 2 https://w3techs.com/technologies/details/ce-http2/all/all 3 results from our own tests help fight against this kind of malicious behavior. We have proposed a classification approach which, combined with a proper set of features, is able to identify the incriminated HTTP/2 traffic even when encrypted.…”

“…The paper is organized as follows. Section II presents related works and background, in particular our classification technique omitting in-depth details available in [1]. Our test methodology is given in Section III along with dataset descriptions.…”

A new classification method for encrypted internet traffic using machine learning

“…With the increasing importance of privacy, especially in internet use, users prefer encrypted channels. The rate of usage of Secure Hyper Text Transfer Protocol (HTTPS) traffic on the internet is over 88% and it is gradually increasing [1]. In the absence of encryption, critical data such as personal, commercial or military information can be captured by cyber attackers listening to the line or network [2].…”