https traffic
221743629
Attention based bidirectional GRU networks for efficient HTTPS traffic classification
Abstract Distributed and pervasive web services have become a major platform for sharing information. However, the hypertext transfer protocol secure (HTTPS) which is a crucial web encryption technology for protecting the information security of users, creates a supervisory burden for network management (e.g. quality of service guarantees and traffic engineering) Identifying various types of encrypted traffic is crucial for cyber security and network management. In this paper, we propose a novel deep learning model called BGRUA to identify the web services running on HTTPS connections accurately. BGRUA utilizes a bidirectional gated recurrent unit (GRU) and attention mechanism to improve the accuracy of HTTPS traffic classification. The bidirectional GRU is used to extract the forward and backward features of the byte sequences in a session. The attention mechanism is adopted to assign weights to features according to their contributions to classification. Additionally, we investigate the effects of different hyperparameters on the performance of BGRUA and present a set of optimal values that can serve as a basis for future relevant studies. Comparisons to existing methods based on three typical datasets demonstrate that BGRUA outperforms state of the art encrypted traffic classification approaches in terms of accuracy, precision, recall, and F1 score.
Inf. Sci.
Xun Liu Junling You Yulei Wu Tong Li Liangxiong Li Zheyuan Zhang Jingguo Ge
221172807
A Survey of HTTPS Traffic and Services Identification Approaches
HTTPS is quickly rising alongside the need of Internet users to benefit from security and privacy when accessing the Web, and it becomes the predominant application protocol on the Internet. This migration towards a secure Web using HTTPS comes with important challenges related to the management of HTTPS traffic to guarantee basic network properties such as security, QoS, reliability, etc. But encryption undermines the effectiveness of standard monitoring techniques and makes it difficult for ISPs and network administrators to properly identify and manage the services behind HTTPS traffic. This survey details the techniques used to monitor HTTPS traffic, from the most basic level of protocol identification (TLS, HTTPS) to the finest identification of precise services. We show that protocol identification is well mastered while more precise levels keep being challenging despite recent advances. We also describe practical solutions that lead us to discuss the trade off between security and privacy and the research directions to guarantee both of them.
ArXiv
Wazen M Shbair Thibault Cholez Jerome Francois Isabelle Chrisment
201067581
Mobile Application Identification Over HTTPS Traffic Based on Multi view Features
The expanding volume of HTTPS traffic (both legitimate and malicious) creates even more challenges for mobile network security and management. In this work, we propose AIBMF(Application Identification Based on Multi view Features) a fine grained approach to classify HTTPS traffic by their application type. The key idea of AIBMF is to combine three kinds of features payload convolution features, packet size sequence and packet content type sequence. Based on these different view features, a deep learning model (using CNN, embedding and RNN) is constructed for HTTPS traffic identification task. To evaluate the effectiveness of AIBMF, we run a comprehensive set of experiments on a real world dataset (about 100,000+ flows) which shows that our approach achieves 96.06% accuracy and outperforms the state of the art method (3.6% on F1 score)
2019 26th International Conference on Telecommunications (ICT)
Mao Tian Peng Chang Yafei Sang Yongzheng Zhang Shuhao Li
199527263
Realistically Fingerprinting Social Media Webpages in HTTPS Traffic
In webpage fingerprinting (WPF) an adversary attempts to identify webpages in encrypted network traffic. Identifying social media webpages however is a challenging task, due to the similarity and dynamic nature of such pages. Existing webpage fingerprinting attacks often have unrealistic assumptions regarding the capability of government agencies or knowledge of the criminal's environment, which renders these attacks ineffective when applied to social media platforms. In this paper, we unravel the current concerns in state of the art WPF attacks in a social network context for forensic analysis. To resolve the issues presented, we propose an enhanced version of the WPF attack 'IUPTIS' and introduce an intelligent observer that significantly improves upon previous works. Furthermore, our improvements are compared to related WPF attacks by conducting extensive experiments on two social platforms: Twitter and Instagram. Our examination shows that the improved IUPTIS attack defeats previous works in terms of realistic obstacles such as HTTP/2, caching and performance costs, thus making it feasible to identify social media webpages with minimal resources.
ARES
Mariano Di Martino Peter Quax Wim Lamotte
3719178
HTTPS traffic analysis and client identification using passive SSL/TLS fingerprinting
The encryption of network traffic complicates legitimate network monitoring, traffic analysis, and network forensics. In this paper, we present real time lightweight identification of HTTPS clients based on network monitoring and SSL/TLS fingerprinting. Our experiment shows that it is possible to estimate the User Agent of a client in HTTPS communication via the analysis of the SSL/TLS handshake. The fingerprints of SSL/TLS handshakes, including a list of supported cipher suites, differ among clients and correlate to User Agent values from a HTTP header. We built up a dictionary of SSL/TLS cipher suite lists and HTTP User Agents and assigned the User Agents to the observed SSL/TLS connections to identify communicating clients. The dictionary was used to classify live HTTPS network traffic. We were able to retrieve client types from 95.4 of HTTPS network traffic. Further, we discussed host based and network based methods of dictionary retrieval and estimated the quality of the data.
EURASIP J. Inf. Secur.
Martin Husak Milan Cermak Tomas Jirsik Pavel Celeda
20133916
k NN Classification of Malware in HTTPS Traffic Using the Metric Space Approach
In this paper, we present detection of malware in HTTPS traffic using k NN classification. We focus on the metric space approach for approximate k NN searches over dataset of sparse high dimensional descriptors of network traffic. We show the classification based on approximate k NN search using metric index exhibits false positive rate reduced by an order of magnitude when compared to the state of the art method, while keeping the classification fast enough.
PAISI
Jakub Lokoc Jan Kohout Premysl Cech Tomas Skopal Tomas Pevny
729696
I Know Why You Went to the Clinic: Risks and Realization of HTTPS Traffic Analysis
Revelations of large scale electronic surveillance and data mining by governments and corporations have fueled increased adoption of HTTPS. We present a traffic analysis attack against over 6000 webpages spanning the HTTPS deployments of 10 widely used, industry leading websites in areas such as healthcare, finance, legal services and streaming video. Our attack identifies individual pages in the same website with 90% accuracy, exposing personal details including medical conditions, financial and legal affairs and sexual orientation. We examine evaluation methodology and reveal accuracy variations as large as 17% caused by assumptions affecting caching and cookies. We present a novel defense reducing attack accuracy to 25% with a 9% traffic increase, and demonstrate significantly increased effectiveness of prior defenses in our evaluation context, inclusive of enabled caching, user specific cookies and pages within the same website.
Privacy Enhancing Technologies
Brad Miller Ling Huang Anthony D Joseph J Doug Tygar
3993142
Malware Detection by HTTPS Traffic Analysis
In order to evade detection by network traffic analysis, a growing proportion of malware uses the encrypted HTTPS protocol. We explore the problem of detecting malware on client computers based on HTTPS traffic analysis. In this setting, malware has to be detected based on the host IP address, ports, timestamp, and data volume information of TCP/IP packets that are sent and received by all the applications on the client. We develop a scalable protocol that allows us to collect network flows of known malicious and benign applications as training data and derive a malware detection method based on a neural networks and sequence classification. We study the method's ability to detect known and new, unknown malware in a large scale empirical study.
Paul Prasse Gerrit Gruben Lukas Machlika Tomas Pevny Michal Sofka Tobias Scheffer
155099183
Observer Effect: How Intercepting HTTPS Traffic Forces Malware to Change Their Behavior
During the last couple of years there has been an important surge on the use of HTTPs by malware. The reason for this increase is not completely understood yet, but it is hypothesized that it was forced by organizations only allowing web traffic to the Internet. Using HTTPs makes malware behavior similar to normal connections. Therefore, there has been a growing interest in understanding the usage of HTTPs by malware. This paper describes our research to obtain large quantities of real malware traffic using HTTPs, our use of man in the middle HTTPs interceptor proxies to open and study the content, and our analysis of how the behavior of the malware changes after being intercepted. The research goal is to understand how malware uses HTTPs and the impact of intercepting its traffic. We conclude that the use of an interceptor proxy forces the malware to change its behavior and therefore should be carefully considered before being implemented.
CACIC
Maria Jose Erquiaga Sebastian Garcia Carlos Garcia Garino
11720319
Selective HTTPS traffic manipulation at middleboxes for BYOD devices
HTTPS has become a vital component of the WWW ecosystem. However, today's application layer middleboxes in the cloud are largely "blind" to HTTPS traffic. We propose a novel system infrastructural solution, called CloudEye, that allows middleboxes to selectively manipulate HTTPS traffic. A key design philosophy of CloudEye is to hide all the complexity from client and server applications (thus being transparent to them) and to have middlebox related functions managed by a dedicated OS service. CloudEye provides control of what information the middlebox can access through new techniques such as HTTPS tags and shadow connections, without changing the TLS/SSL or HTTP protocol. CloudEye is secure and easy to use. We implemented its prototype on Linux/Android, and demonstrated its low overhead and rich use cases on off the shelf mobile devices and cloud servers.
2017 IEEE 25th International Conference on Network Protocols (ICNP)
Xing Liu Feng Qian Zhiyun Qian