Abstract:The widespread adoption of encrypted communication protocols has significantly enhanced network security and user privacy, simultaneously elevating the importance of encrypted traffic analysis across various domains, including network anomaly detection. The Transport Layer Security (TLS) 1.3 protocol, introduced in 2018, has gained rapid popularity due to its enhanced security features and improved performance. However, TLS 1.3's security enhancements, such as encrypting more of the handshake process, present unprecedented challenges for encrypted traffic analysis, rendering traditional methods designed for TLS 1.2 and earlier versions ineffective and necessitating the development of novel analytical techniques. This comprehensive survey provides a thorough review of the latest advancements in TLS 1.3 traffic analysis. First, we examine the impact of TLS 1.3's new features, including Encrypted ClientHello (ECH), 0-RTT session resumption, and Perfect Forward Secrecy (PFS), on existing traffic analysis techniques. We then present a systematic overview of state-of-the-art methods for analyzing TLS 1.3 traffic, encompassing middlebox-based interception, searchable encryption, and machine learning-based approaches. For each method, we provide a critical analysis of its advantages, limitations, and applicable scenarios. Furthermore, we compile and review key datasets utilized in machine learning-based TLS 1.3 traffic analysis research. Finally, we discuss the main challenges and potential future research directions for TLS 1.3 traffic analysis. Given that TLS 1.3 is still in the early stages of widespread deployment, research in this field remains nascent. This survey aims to provide researchers and practitioners with a comprehensive reference, facilitating the development of more effective TLS 1.3 traffic analysis techniques that balance network security requirements with user privacy protection.

Drpsd: An Novel Method Of Identifying Ssl/Tls Traffic

An Novel Hybrid Method for Effectively Classifying Encrypted Traffic

TPDD: A Two-Phase DDoS Detection System in Software-Defined Networking

SSL-DP: A Rootkit of Network Based SSL and TLS Traffic Decryptor

Deep-Forest-Based Encrypted Malicious Traffic Detection

A Heuristic Statistical Testing Based Approach for Encrypted Network Traffic Identification.

A Survey on Encrypted Traffic Identification

Seeing Traffic Paths: Encrypted Traffic Classification With Path Signature Features

Protocol Independent Identification of Encrypted Traffic Based on Weighted Cumulative Sum Test

Signcryption-Based Encrypted Traffic Detection Scheme for Fast Establishing Secure Connections.

Identification Of P2p Traffic Based On The Content Redistribution Characteristic

A survey of methods for encrypted network traffic fingerprinting

An Efficient Security System for Mobile Data Monitoring.

A Deep Learning-Based Encrypted VPN Traffic Classification Method Using Packet Block Image

THS-IDPC: A three-stage hierarchical sampling method based on improved density peaks clustering algorithm for encrypted malicious traffic detection

A Survey of HTTPS Traffic and Services Identification Approaches

Challenges and Advances in Analyzing TLS 1.3-Encrypted Traffic: A Comprehensive Survey

Fine-Grained Webpage Fingerprinting Using Only Packet Length Information of Encrypted Traffic

Rethinking Robust and Accurate Application Protocol Identification: A Nonparametric Approach

Fingerprinting Sdn Applications Via Encrypted Control Traffic

Understanding IP Address Multiplexing with Large-Scale SSL/TLS Flow Analysis