Abstract:Middleboxes in a computer network system inspect and analyse network traffic to detect malicious communications, monitor system performance and provide operational services. However, encrypted traffic hinders the ability of middleboxes to perform such services. A common practice in addressing this issue is by employing a "Man-in-the-Middle" (MitM) approach, wherein an encrypted traffic flow between two endpoints is interrupted, decrypted and analysed by the middleboxes. The MitM approach is straightforward and is used by many organisations, but there are both practical and privacy concerns. Due to the cost of the MitM appliances and the latency incurred in the encrypt-decrypt processes, enterprises continue to seek solutions that are less costly. There were discussion on the many efforts required to configure MitM. Besides, MitM violates end-to-end privacy guarantee, raising privacy concerns and issues on compliance especially with the rising awareness on user privacy. Furthermore, some of the MitM implementations were found to be flawed. Consequently, new practical and privacy-preserving techniques for inspection over encrypted traffic were proposed. We examine them to compare their advantages, limitations and challenges. We categorise them into four main categories by defining a framework that consist of system architectures, use cases, trust and threat models. These are searchable encryption, access control, machine learning and trusted hardware. We first discuss the man-in-the-middle approach as a baseline, then discuss in details each of them, and provide an in-depth comparisons of their advantages and limitations. By doing so we describe practical constraints, advantages and pitfalls towards adopting the techniques. We also give insights on the gaps between research work and industrial deployment, which leads us to the discussion on the challenges and research directions.

Multilayer Network Monitoring and Data Analytics over Encrypted Telemetry Data

Privacy-Preserving Multilayer In-Band Network Telemetry and Data Analytics (<i>Invited Paper</i>)

Privacy-Preserving Multilayer In-Band Network Telemetry and Data Analytics: For Safety, Please do Not Report Plaintext Data

Toward Security-Enhanced In-band Network Telemetry in Programmable Networks

In-band Network Telemetry Manipulation Attacks and Countermeasures in Programmable Networks.

Industrial Scale Privacy Preserving Deep Neural Network

Network Coding Based Privacy Preservation Against Traffic Analysis in Multi-Hop Wireless Networks

Programmable Multilayer INT: an Enabler for AI-Assisted Network Automation

Visualize Your IP-Over-Optical Network in Realtime: A P4-Based Flexible Multilayer In-Band Network Telemetry (ML-INT) System

Leveraging Multilayer Telemetry to Realize AI-assisted Service Provisioning in IP over Elastic Optical Networks: (invited Paper).

SecureNT: A Practical Framework for Efficient Topology Protection and Monitoring

Entropy-Driven Adaptive INT and Its Applications in Network Automation of IP-Over-EONs

A Data-Fusion-Assisted Telemetry Layer for Autonomous Optical Networks

A Survey of Privacy-Preserving Techniques for Encrypted Traffic Inspection over Network Middleboxes

Preserving Data Privacy for ML-driven Applications in Open Radio Access Networks

Adversarial Analysis of ML-Based Anomaly Detection in Multi-Layer Network Automation

Self-Adaptive Network Monitoring in IP-over-EONs: when Multilayer Telemetry is Flexible and Driven by Data Analytics.

Elastic optical network routing analysis using intelligent machine learning architecture with security analysis

Enabling Secure Intelligent Network with Cloud-Assisted Privacy-Preserving Machine Learning

AI-Enhanced VPN Security Framework: Integrating Open-Source Threat Intelligence and Machine Learning to Secure Digital Networks

Privacy preserving layer partitioning for Deep Neural Network models