Abstract:Privacy protection in computer communication is gaining attention because plaintext transmission without encryption can be eavesdropped on and intercepted. Accordingly, the use of encrypted communication protocols is on the rise, along with the number of cyberattacks exploiting them. Decryption is essential for preventing attacks, but it risks privacy infringement and incurs additional costs. Network fingerprinting techniques are among the best alternatives, but existing techniques are based on information from the TCP/IP stack. They are expected to be less effective because cloud-based and software-defined networks have ambiguous boundaries, and network configurations not dependent on existing IP address schemes increase. Herein, we investigate and analyze the Transport Layer Security (TLS) fingerprinting technique, a technology that can analyze and classify encrypted traffic without decryption while addressing the problems of existing network fingerprinting techniques. Background knowledge and analysis information for each TLS fingerprinting technique is presented herein. We discuss the pros and cons of two groups of techniques, fingerprint collection and artificial intelligence (AI)-based. Regarding fingerprint collection techniques, separate discussions on handshake messages ClientHello/ServerHello, statistics of handshake state transitions, and client responses are provided. For AI-based techniques, discussions on statistical, time series, and graph techniques according to feature engineering are presented. In addition, we discuss hybrid and miscellaneous techniques that combine fingerprint collection with AI techniques. Based on these discussions, we identify the need for a step-by-step analysis and control study of cryptographic traffic to effectively use each technique and present a blueprint.

A Fingerprint Enhancement and Second-Order Markov Chain Based Malicious Encrypted Traffic Identification Scheme

Detecting Anomalies In Encrypted Traffic Via Deep Dictionary Learning

A Novel Malware Encrypted Traffic Detection Framework Based on Ensemble Learning

Feature Analysis of Encrypted Malicious Traffic

Rethinking Encrypted Traffic Classification: A Multi-Attribute Associated Fingerprint Approach

A Novel Framework for Malicious Encrypted Traffic Classification at Host Level and Flow Level.

Malicious Encrypted Traffic Identification Based on Four-Tuple Feature and Deep Learning

A Survey of Encrypted Malicious Traffic Detection*

TLS fingerprint for encrypted malicious traffic detection with attributed graph kernel

Semi-Supervised Encrypted Malicious Traffic Detection Based on Multimodal Traffic Characteristics

Enhanced Encrypted Traffic Analysis Leveraging Graph Neural Networks and Optimized Feature Dimensionality Reduction

Counterfeit Fingerprint Detection of Outbound HTTP Traffic with Graph Edit Distance

A survey of methods for encrypted network traffic fingerprinting

TLS-MHSA: An Efficient Detection Model for Encrypted Malicious Traffic based on Multi-Head Self-Attention Mechanism

Graph based Encrypted Malicious Traffic Detection with Hybrid Analysis of Multi-view Features

A novel TLS-based Fingerprinting approach that combines feature expansion and similarity mapping

Flow Interaction Graph Analysis: Unknown Encrypted Malicious Traffic Detection

THS-IDPC: A three-stage hierarchical sampling method based on improved density peaks clustering algorithm for encrypted malicious traffic detection

Spatial-Temporal Feature with Dual-Attention Mechanism for Encrypted Malicious Traffic Detection

Feature Mining for Encrypted Malicious Traffic Detection with Deep Learning and Other Machine Learning Algorithms

Fine-Grained Webpage Fingerprinting Using Only Packet Length Information of Encrypted Traffic