Detail publikace

Towards identification of network applications in encrypted traffic

BURGETOVÁ, I. MATOUŠEK, P. RYŠAVÝ, O.

Originální název

Towards identification of network applications in encrypted traffic

Typ

článek v časopise - ostatní, Jost

Jazyk

angličtina

Originální abstrakt

Network traffic monitoring for security threat detection and network performance management is challenging due to the encryption of most communications. This article addresses the problem of identifying network applications associated with Transport Layer Security (TLS) connections. The evaluation of three primary approaches to classifying TLS-encrypted traffic was carried out: fingerprinting methods, Server Name Indication (SNI)-based identification, and machine learning-based classifiers. Each method has its own strengths and limitations: fingerprinting relies on a regularly updated database of known hashes, SNI is vulnerable to obfuscation or missing information, and AI techniques such as machine learning require sufficient labeled training data. A comparison of these methods highlights the challenges of identifying individual applications, as the TLS properties are significantly shared between applications. Nevertheless, even when identifying a collection of candidate applications, a valuable insight into network monitoring can be gained, and this can be achieved with high accuracy by all the methods considered. To facilitate further research in this area, a novel publicly available dataset of TLS communications has been created, with the communications annotated for popular desktop and mobile applications. Furthermore, the results of three different approaches to refine TLS traffic classification based on a combination of basic classifiers and context are presented. Finally, practical use cases are proposed, and future research directions are identified to further improve application identification methods.

Klíčová slova

TLS fingerprinting, JA4, encrypted traffic, application identification, machine learning

Autoři

BURGETOVÁ, I.; MATOUŠEK, P.; RYŠAVÝ, O.

Vydáno

3. 9. 2025

Nakladatel

Springer Nature

ISSN

1958-9395

Periodikum

ANNALES DES TELECOMMUNICATIONS-ANNALS OF TELECOMMUNICATIONS

Ročník

2025

Číslo

9

Stát

Francouzská republika

Strany od

1

Strany do

18

Strany počet

18

URL

https://link.springer.com/article/10.1007/s12243-025-01114-z

Plný text v Digitální knihovně

http://hdl.handle.net/11012/255531

BibTex

@article{BUT198668,
  author="Ivana {Burgetová} and Petr {Matoušek} and Ondřej {Ryšavý}",
  title="Towards identification of network applications in encrypted traffic",
  journal="ANNALES DES TELECOMMUNICATIONS-ANNALS OF TELECOMMUNICATIONS",
  year="2025",
  volume="2025",
  number="9",
  pages="1--18",
  doi="10.1007/s12243-025-01114-z",
  issn="1958-9395",
  url="https://link.springer.com/article/10.1007/s12243-025-01114-z"
}

Dokumenty

s12243-025-01114-z.pdf