Abstract:Middleboxes in a computer network system inspect and analyse network traffic to detect malicious communications, monitor system performance and provide operational services. However, encrypted traffic hinders the ability of middleboxes to perform such services. A common practice in addressing this issue is by employing a "Man-in-the-Middle" (MitM) approach, wherein an encrypted traffic flow between two endpoints is interrupted, decrypted and analysed by the middleboxes. The MitM approach is straightforward and is used by many organisations, but there are both practical and privacy concerns. Due to the cost of the MitM appliances and the latency incurred in the encrypt-decrypt processes, enterprises continue to seek solutions that are less costly. There were discussion on the many efforts required to configure MitM. Besides, MitM violates end-to-end privacy guarantee, raising privacy concerns and issues on compliance especially with the rising awareness on user privacy. Furthermore, some of the MitM implementations were found to be flawed. Consequently, new practical and privacy-preserving techniques for inspection over encrypted traffic were proposed. We examine them to compare their advantages, limitations and challenges. We categorise them into four main categories by defining a framework that consist of system architectures, use cases, trust and threat models. These are searchable encryption, access control, machine learning and trusted hardware. We first discuss the man-in-the-middle approach as a baseline, then discuss in details each of them, and provide an in-depth comparisons of their advantages and limitations. By doing so we describe practical constraints, advantages and pitfalls towards adopting the techniques. We also give insights on the gaps between research work and industrial deployment, which leads us to the discussion on the challenges and research directions.

Study on Privacy Preserving Encrypted Traffic Detection

Optimizing Feature Selection for Efficient Encrypted Traffic Classification: A Systematic Approach

Seeing Traffic Paths: Encrypted Traffic Classification With Path Signature Features

Multi-Task Scenario Encrypted Traffic Classification and Parameter Analysis

GCN-ETA: High-Efficiency Encrypted Malicious Traffic Detection

Toward identifying malicious encrypted traffic with a causality detection system

Bidirectional Flow-Based Image Representation Method for Detecting Network Traffic Service Categories

Monitoring Smart Home Traffic under Differential Privacy

THS-IDPC: A three-stage hierarchical sampling method based on improved density peaks clustering algorithm for encrypted malicious traffic detection

BehavSniffer: Sniff User Behaviors from the Encrypted Traffic by Traffic Burst Graphs

Semi-Supervised Encrypted Malicious Traffic Detection Based on Multimodal Traffic Characteristics

An encrypted traffic identification method based on multi-scale feature fusion

Network Traffic Classification Model Based on Spatio-Temporal Feature Extraction

TLS-MHSA: An Efficient Detection Model for Encrypted Malicious Traffic based on Multi-Head Self-Attention Mechanism

A Survey of Privacy-Preserving Techniques for Encrypted Traffic Inspection over Network Middleboxes

PrivacySignal: Privacy-Preserving Traffic Signal Control for Intelligent Transportation System

A Survey of Encrypted Malicious Traffic Detection*

Privacy-Preserving Traceable Encrypted Traffic Inspection in Blockchain-based Industrial IoT

A Traffic Density Estimation Model Based on Crowdsourcing Privacy Protection

Efficiently and Effectively: A Two-stage Approach to Balance Plaintext and Encrypted Text for Traffic Classification

A Local Differential Privacy Trajectory Protection Method Based on Temporal and Spatial Restrictions for Staying Detection