Abstract:Middleboxes in a computer network system inspect and analyse network traffic to detect malicious communications, monitor system performance and provide operational services. However, encrypted traffic hinders the ability of middleboxes to perform such services. A common practice in addressing this issue is by employing a "Man-in-the-Middle" (MitM) approach, wherein an encrypted traffic flow between two endpoints is interrupted, decrypted and analysed by the middleboxes. The MitM approach is straightforward and is used by many organisations, but there are both practical and privacy concerns. Due to the cost of the MitM appliances and the latency incurred in the encrypt-decrypt processes, enterprises continue to seek solutions that are less costly. There were discussion on the many efforts required to configure MitM. Besides, MitM violates end-to-end privacy guarantee, raising privacy concerns and issues on compliance especially with the rising awareness on user privacy. Furthermore, some of the MitM implementations were found to be flawed. Consequently, new practical and privacy-preserving techniques for inspection over encrypted traffic were proposed. We examine them to compare their advantages, limitations and challenges. We categorise them into four main categories by defining a framework that consist of system architectures, use cases, trust and threat models. These are searchable encryption, access control, machine learning and trusted hardware. We first discuss the man-in-the-middle approach as a baseline, then discuss in details each of them, and provide an in-depth comparisons of their advantages and limitations. By doing so we describe practical constraints, advantages and pitfalls towards adopting the techniques. We also give insights on the gaps between research work and industrial deployment, which leads us to the discussion on the challenges and research directions.

Packet Sniffing in the Cyber Threat Landscape: Examining Wireshark Capabilities, Misuse, and Policy Options in the Philippines

Exploring Wireshark For Network Traffic Analysis

Internet Security Awareness of Filipinos: A Survey Paper

Implementation of Webservice Security: A Case Study on HTTPS Usage and ARP Spoofing Attack Threats

Secure Wirelessly Powered Networks at the Physical Layer: Challenges, Countermeasures, and Road Ahead

Unauthorized and Privacy-Intrusive Human Activity Watching Through Wi-Fi Signals: an Emerging Cybersecurity Threat

Wireless Local Area Network Security through Protocol Wireless Protected Access

Analysis of Human Awareness of Security and Privacy Threats in Smart Environments

A Framework for Threats Analysis Using Software-Defined Networking

Enhancing Data Privacy In Wireless Sensor Networks: Investigating Techniques And Protocols To Protect Privacy Of Data Transmitted Over Wireless Sensor Networks In Critical Applications Of Healthcare And National Security

Evaluation of Enhanced Security Solutions in 802.11-Based Networks

Port Forwarding Services Are Forwarding Security Risks

A Comprehensive Analysis of Pegasus Spyware and Its Implications for Digital Privacy and Security

Bugs in our pockets: the risks of client-side scanning

Enhancing Users’ Wireless Network Cyber Security and Privacy Concerns during COVID-19

The Role of Client Isolation in Protecting Wi-Fi Users from ARP Spoofing Attacks

Exploring LoRaWAN Traffic: In-Depth Analysis of IoT Network Communications

A Survey of Privacy-Preserving Techniques for Encrypted Traffic Inspection over Network Middleboxes

Intranet Security using a LAN Packet Sniffer to Monitor Traffic

SoK: Secure Human-centered Wireless Sensing

SniffMislead - Non-Intrusive Privacy Protection against Wireless Packet Sniffers in Smart Homes.