tls traffic
232043077
Research on Malicious TLS Traffic Identification Based on Hybrid Neural Network
In this paper, the method of the hybrid neural network is used to identify malicious TLS traffic, and the network traffic anomaly detection algorithm based on logistic regression and decision tree and the distributed denial of service attack detection algorithm based on hybrid neural network algorithm and gradient lifting tree is proposed. It found that there is a general problem of high feature dimensions in network traffic detection. The useless features will increase the computational complexity of traffic anomaly detection and reduce accuracy. Based on the feature selection method of recursive feature elimination and logistic regression, the importance ranking of flow features obtained. Using the accuracy rate as an indicator, a decision tree algorithm used to model and predict network traffic. During network traffic anomaly detection, it is difficult to distinguish between normal traffic and denial of service attack traffic. The network traffic anomaly detection method based on the decision tree has low computational complexity and can save detection time. At the same time, the accuracy of the algorithm when detecting network traffic anomalies has been significantly improved, and the false alarm rate can also be reduced.
2020 International Conference on Advance in Ambient Computing and Intelligence (ICAACI)
Fang Jie
215833402
Detecting Bot Networks Based On HTTP And TLS Traffic Analysis
Abstract Bot networks are a serious threat to cyber security, whose destructive behavior affects network performance directly. Detecting of infected HTTP communications is a big challenge because infected HTTP connections are clearly merged with other types of HTTP traffic. Cybercriminals prefer to use the web as a communication environment to launch application layer attacks and secretly engage in forbidden activities, while TLS (Transport Layer Security) protocols allow encrypted communication between client and server in the context of Internet provides. Methods of analyzing traffic behavior do not depend on payloads. This means that they can work with encrypted network communication protocols. Traffic behavior analysis methods do not depend on package shipments, which means they can work with encrypted network communication protocols. Hence, the analysis of TLS and HTTP traffic behavior has been considered for detecting malicious activities. Because of the exchange of information in the network context is very high and the volume of information is very large, storing and indexing of this massive data require a Big data platform.
Zahra Nafarieh
208194045
Detecting Malware in TLS Traffic
The use of encryption on the Internet has spread rapidly these last years, a trend encouraged by the growing concerns about online privacy. TLS (Transport Layer Security) the standard protocol for packet encryption, is now implemented by every major websites to protect users' messages, transactions and credentials. However cybercriminals have started to incorporate TLS into their activities. An increasing number of malware leverage TLS encryption to hide their communications and to exfiltrate data to their command server, effectively bypassing traditional detection platforms. The goal of this project is to design and implement an effective alternative to the unpractical method of decrypting TLS packets' payload before looking for signs of malware activity. This work presents a highly accurate supervised classifier that can detect malicious TLS flows in a company's network traffic based on a set of features related to TLS, certificates and flow metadata. The classifier was trained on curated datasets of benign and malware observations, which were extracted from capture files thanks to a set of tools specially developed for this purpose. We detail in this report the complete development process, from data collection and feature extraction to model selection and performance analysis.
Olivier Roques
203696714
A machine learning approach to detecting malware in TLS traffic using resilient network features
The growth of malware utilizing encrypted channels makes it challenging to detect malicious activity using current Network Intrusion Detection Systems (NIDSs) The current network intrusion detection systems utilize pattern matching algorithms to identify malware artifacts in the network traffic. In Transport Layer Security (TLS) encrypted networks, limited amount of data are available for the NIDS. This obstacle is exploited by malware authors to evade detection. In this thesis, we are looking into using machine learning classification algorithms to recognize malware communication within TLS channels without having to decrypt the network traffic. In the last few years, an increase in research has been looking into solutions for this problem using classification algorithms. We extend the existing research by identifying features in the TLS traffic that is resilient to evasion techniques used by more advanced types of malware. Advanced malware is more problematic to detect with traditional NIDSs since they try to evade these systems by generating traffic that is similar to ordinary corporate traffic. Features identified as resilient towards these evasion techniques are those describing the malware behavior in TLS encrypted traffic. Extracting behavior artifacts are performed with a mature NIDS and Network Security Monitoring (NSM) system called Suricata and Metadata Collector, a tool developed as a part of this thesis. With efficient classification algorithms, we can overcome some major challenges of NIDS face today.
Odin Jenseg
207960159
Efficient and Transparent Method for Large Scale TLS Traffic Analysis of Browsers and Analogous Programs
Many famous attacks take web browsers as transmission channels to make the target computer infected by malwares, such as watering hole and domain name hijacking. In order to protect the data transmission, the SSL/TLS protocol has been widely used to defeat various hijacking attacks. However, the existence of such encryption protection makes the security software and devices confront with the difficulty of analyzing the encrypted malicious traffic at endpoints. In order to better solve this kind of situation, this paper proposes a new efficient and transparent method for large scale automated TLS traffic analysis, named as hyper TLS traffic analysis (HTTA) It extracts multiple types of valuable data from the target system in the hyper mode and then correlates them to decrypt the network packets in real time, so that overall data correlation analysis can be performed on the target. Additionally, we propose an aided reverse engineering method to support the analysis, which can rapidly identify the target data in different versions of the program. The proposed method can be applied to the endpoints and cloud platforms; there are no trust risk of certificates and no influence on the target programs. Finally, the real experimental results show that the method is feasible and effective for the analysis, which leads to the lower runtime overhead compared with other methods. It covers all the popular browser programs with good adaptability and can be applied to the large scale analysis.
Secur. Commun. Networks
Jiaye Pan Yi Zhuang Binglin Sun
49728953
Decrypting SSL/TLS traffic for hidden threats detection
The paper presents an analysis of the main mechanisms of decryption of SSL/TLS traffic. Methods and technologies for detecting malicious activity in encrypted traffic that are used by leading companies are also considered. Also, the approach for intercepting and decrypting traffic transmitted over SSL/TLS is developed, tested and proposed. The developed approach has been automated and can be used for remote listening of the network, which will allow to decrypt transmitted data in a mode close to real time.
2018 IEEE 9th International Conference on Dependable Systems, Services and Technologies (DESSERT)
Tamara Radivilova Lyudmyla Kirichenko Dmytro Ageyev Maxim Tawalbeh Vitalii Bulakh
88491906
TLS: traffic load based scheduling protocol for wireless sensor networks
In wireless sensor networks (WSNs) nodes are usually deployed in the monitoring region randomly and densely and are supposed to monitor the region for a longer duration. These sensors are normally powered by a battery and therefore it is essential to regulate the power utilisation of the nodes efficiently. Although most of the current protocols reduce the power utilisation by regulating the sleep and wake up schedules, they fail to make an adaptive sleep or wake up schedule for the nodes based on their traffic load. This paper proposes a traffic load based adaptive node scheduling protocol to determine the active and sleep schedules of the nodes. The entire network is partitioned into a set of virtual zones and a routing path selection algorithm is proposed considering the residual power of the next hop nodes. Simulation results show that the energy consumption and packet overhead of our protocol are considerably less as compared to similar quorum based medium access control (MAC) protocols.
Prasan Kumar Sahoo Hiren Kumar Thakkar
129946424
TLS: traffic load based scheduling protocol for wireless sensor networks
Int. J. Ad Hoc Ubiquitous Comput.
Prasan Kumar Sahoo Hiren Kumar Thakkar
64880138
Identifying and detecting applications within TLS traffic
Internet traffic is increasingly becoming encrypted, making the forensic analysis of packet content yield diminishing returns. Much traffic (web, email, chat, VoIP, etc. is now protected using the cryptographic protocol known as Transport Layer Security (TLS) In 2014, Google encouraged increased TLS usage by favoring HTTPS in its search (SEO) rankings1. As a result, by 2016, approximately 30 percent of the top page search results on Google used HTTPS (SSL/TLS)1. While the largest fraction of traffic is now video (e.g. Netflix, YouTube) these communications too now use TLS2. Traditional traffic analysis leverages port numbers, domain names, certificate fields, and the available cryptographic suites. TLS fingerprinting3 for traffic classification4 has recently been used, but this is still insufficient to expose suspicious communication. In the absence of actual payload content, additional information such as the inter packet arrival times, flow direction, TCP headers, and frequencies can be leveraged to estimate the application and data protected with SSL/TLS. For example, researchers leveraged supervised machine learning and a set of features such as previously suggested (packet arrival times, length, etc. and achieved a 96% accuracy when predicting the 3 tuple of <Operating System, Browser, Application< of various SSL/TLS applications5. Our novel technique leverages data mining techniques and the TLS record size frequencies. We then leverage Multinomial Naive Bayes and the K means algorithm to respectively classify TLS sessions to a website and cluster the TLS sessions. We have achieved an accuracy of 90.5% in Multinomial Naive Bayes Classification of websites and a V measure of 89.9% and a Silhouette Coefficient of 54.6% in K means clustering of TLS Sessions according to websites.
Defense Security
Michael J De Lucia Chase Cotton
171096514
Orchestrating an SFC enabled SSL/TLS traffic processing architecture using MANO
The heterogeneity of 5G requirements commands more complex network architectures, imposing the need for network orchestration. ETSI NFV MANO is the standard which defines a common framework for vendors and operators to integrate their orchestration efforts. In this paper, we evaluated how an ETSI NFV MANO compliant orchestrator (OSM) fares while orchestrating an SFC enabled SSL/TLS encrypted traffic processing architecture, which supports both edge and cloud deployments. A quantitative evaluation was carried out, which assessed the responsiveness and overheads of OSM, as well as the actual functionality of our SSL/TLS processing architecture (with edge computing components) A qualitative evaluation was also carried out, providing insight into the maturity of the current OSM release, what works well, what requires workarounds, and the actual limitations. A demonstration of the architecture evaluated in this work was accepted as a contribution to the ETSI OSM PoC Framework.
2018 IEEE Conference on Network Function Virtualization and Software Defined Networks (NFV SDN)
Eduardo Sousa Vitor A Cunha Marcio Barbosa de Carvalho Daniel Corujo Joao Paulo Barraca Diogo Nuno Pereira Gomes Alberto Egon Schaeffer Filho Carlos Raniery Paula dos Santos Lisandro Zambenedetti Granville Rui Luis Aguiar