Abstract:The widespread adoption of encrypted communication protocols has significantly enhanced network security and user privacy, simultaneously elevating the importance of encrypted traffic analysis across various domains, including network anomaly detection. The Transport Layer Security (TLS) 1.3 protocol, introduced in 2018, has gained rapid popularity due to its enhanced security features and improved performance. However, TLS 1.3's security enhancements, such as encrypting more of the handshake process, present unprecedented challenges for encrypted traffic analysis, rendering traditional methods designed for TLS 1.2 and earlier versions ineffective and necessitating the development of novel analytical techniques. This comprehensive survey provides a thorough review of the latest advancements in TLS 1.3 traffic analysis. First, we examine the impact of TLS 1.3's new features, including Encrypted ClientHello (ECH), 0-RTT session resumption, and Perfect Forward Secrecy (PFS), on existing traffic analysis techniques. We then present a systematic overview of state-of-the-art methods for analyzing TLS 1.3 traffic, encompassing middlebox-based interception, searchable encryption, and machine learning-based approaches. For each method, we provide a critical analysis of its advantages, limitations, and applicable scenarios. Furthermore, we compile and review key datasets utilized in machine learning-based TLS 1.3 traffic analysis research. Finally, we discuss the main challenges and potential future research directions for TLS 1.3 traffic analysis. Given that TLS 1.3 is still in the early stages of widespread deployment, research in this field remains nascent. This survey aims to provide researchers and practitioners with a comprehensive reference, facilitating the development of more effective TLS 1.3 traffic analysis techniques that balance network security requirements with user privacy protection.

Review and Perspective on Encrypted Traffic Identification Research

A Survey on Encrypted Traffic Identification

Unidirectional Encrypted Traffic Classification: A Survey

Challenges and Advances in Analyzing TLS 1.3-Encrypted Traffic: A Comprehensive Survey

Machine Learning-Powered Encrypted Network Traffic Analysis: A Comprehensive Survey.

A Survey of Privacy-Preserving Techniques for Encrypted Traffic Inspection over Network Middleboxes

A Survey of HTTPS Traffic and Services Identification Approaches

A Survey of Encrypted Malicious Traffic Detection*

Seeing Traffic Paths: Encrypted Traffic Classification With Path Signature Features

Application-layer Characterization and Traffic Analysis for Encrypted QUIC Transport Protocol

Encrypted Traffic Identification Based on N-gram Entropy and Cumulative Sum Test

Application of Encrypted Communications and Identify Technique in Electronic Commerce

A Survey on Network Traffic Identification

Few-Shot Encrypted Traffic Classification: A Survey

A Heuristic Statistical Testing Based Approach for Encrypted Network Traffic Identification.

A survey of methods for encrypted network traffic fingerprinting

Research Prospects of User Information Detection from Encrypted Traffic of Mobile Devices

Optimizing Feature Selection for Efficient Encrypted Traffic Classification: A Systematic Approach

Encrypted Traffic Classification Based on Traffic Reconstruction

An Encrypted Traffic Identification Scheme Based on the Multilevel Structure and Variational Automatic Encoder

Online Identification of Tor Anonymous Communication Traffic