Abstract:The widespread adoption of encrypted communication protocols has significantly enhanced network security and user privacy, simultaneously elevating the importance of encrypted traffic analysis across various domains, including network anomaly detection. The Transport Layer Security (TLS) 1.3 protocol, introduced in 2018, has gained rapid popularity due to its enhanced security features and improved performance. However, TLS 1.3's security enhancements, such as encrypting more of the handshake process, present unprecedented challenges for encrypted traffic analysis, rendering traditional methods designed for TLS 1.2 and earlier versions ineffective and necessitating the development of novel analytical techniques. This comprehensive survey provides a thorough review of the latest advancements in TLS 1.3 traffic analysis. First, we examine the impact of TLS 1.3's new features, including Encrypted ClientHello (ECH), 0-RTT session resumption, and Perfect Forward Secrecy (PFS), on existing traffic analysis techniques. We then present a systematic overview of state-of-the-art methods for analyzing TLS 1.3 traffic, encompassing middlebox-based interception, searchable encryption, and machine learning-based approaches. For each method, we provide a critical analysis of its advantages, limitations, and applicable scenarios. Furthermore, we compile and review key datasets utilized in machine learning-based TLS 1.3 traffic analysis research. Finally, we discuss the main challenges and potential future research directions for TLS 1.3 traffic analysis. Given that TLS 1.3 is still in the early stages of widespread deployment, research in this field remains nascent. This survey aims to provide researchers and practitioners with a comprehensive reference, facilitating the development of more effective TLS 1.3 traffic analysis techniques that balance network security requirements with user privacy protection.

Machine learning interpretability meets TLS fingerprinting

A survey of methods for encrypted network traffic fingerprinting

TLS fingerprint for encrypted malicious traffic detection with attributed graph kernel

Fingerprinting User Privacy in Web Applications

A novel TLS-based Fingerprinting approach that combines feature expansion and similarity mapping

Adaptive Webpage Fingerprinting from TLS Traces

A survey and analysis of TLS interception mechanisms and motivations

Detecting Malignant TLS Servers Using Machine Learning Techniques

Deciphering Malware's use of TLS (without Decryption)

Your Smart Home Can't Keep a Secret: Towards Automated Fingerprinting of IoT Traffic with Neural Networks

Measuring Information Leakage in Website Fingerprinting Attacks and Defenses

Domain Name Encryption Is Not Enough: Privacy Leakage via IP-based Website Fingerprinting

Challenges in Adapting ECH in TLS for Privacy Enhancement over the Internet

Unveiling the Digital Fingerprints: Analysis of Internet attacks based on website fingerprints

Identification of Bugs and Vulnerabilities in TLS Implementation for Windows Operating System Using State Machine Learning

Firewall fingerprinting

Explainable Machine Learning-Based Security and Privacy Protection Framework for Internet of Medical Things Systems

Robust Machine Learning for Encrypted Traffic Classification

Convolutional neural network-based identification of malicious traffic for TLS encryption

Challenges and Advances in Analyzing TLS 1.3-Encrypted Traffic: A Comprehensive Survey

Active TLS Stack Fingerprinting: Characterizing TLS Server Deployments at Scale