Abstract:The widespread adoption of encrypted communication protocols has significantly enhanced network security and user privacy, simultaneously elevating the importance of encrypted traffic analysis across various domains, including network anomaly detection. The Transport Layer Security (TLS) 1.3 protocol, introduced in 2018, has gained rapid popularity due to its enhanced security features and improved performance. However, TLS 1.3's security enhancements, such as encrypting more of the handshake process, present unprecedented challenges for encrypted traffic analysis, rendering traditional methods designed for TLS 1.2 and earlier versions ineffective and necessitating the development of novel analytical techniques. This comprehensive survey provides a thorough review of the latest advancements in TLS 1.3 traffic analysis. First, we examine the impact of TLS 1.3's new features, including Encrypted ClientHello (ECH), 0-RTT session resumption, and Perfect Forward Secrecy (PFS), on existing traffic analysis techniques. We then present a systematic overview of state-of-the-art methods for analyzing TLS 1.3 traffic, encompassing middlebox-based interception, searchable encryption, and machine learning-based approaches. For each method, we provide a critical analysis of its advantages, limitations, and applicable scenarios. Furthermore, we compile and review key datasets utilized in machine learning-based TLS 1.3 traffic analysis research. Finally, we discuss the main challenges and potential future research directions for TLS 1.3 traffic analysis. Given that TLS 1.3 is still in the early stages of widespread deployment, research in this field remains nascent. This survey aims to provide researchers and practitioners with a comprehensive reference, facilitating the development of more effective TLS 1.3 traffic analysis techniques that balance network security requirements with user privacy protection.

Indistinguishability of Traffic by Open TLS Parameters with Encrypted ClientHello

Challenges in Adapting ECH in TLS for Privacy Enhancement over the Internet

Seeing Traffic Paths: Encrypted Traffic Classification With Path Signature Features

Rethinking Encrypted Traffic Classification: A Multi-Attribute Associated Fingerprint Approach

A survey and analysis of TLS interception mechanisms and motivations

Unidirectional Encrypted Traffic Classification: A Survey

A survey of methods for encrypted network traffic fingerprinting

Challenges and Advances in Analyzing TLS 1.3-Encrypted Traffic: A Comprehensive Survey

Optimizing Feature Selection for Efficient Encrypted Traffic Classification: A Systematic Approach

An Novel Hybrid Method for Effectively Classifying Encrypted Traffic

Classifying Tor Traffic Encrypted Payload Using Machine Learning

TLS fingerprint for encrypted malicious traffic detection with attributed graph kernel

Application-layer Characterization and Traffic Analysis for Encrypted QUIC Transport Protocol

Multi-Task Scenario Encrypted Traffic Classification and Parameter Analysis

Convolutional neural network-based identification of malicious traffic for TLS encryption

Encrypted Network Traffic Analysis and Classification Utilizing Machine Learning

Decrypting SSL/TLS traffic for hidden threats detection

Non-uniformity is All You Need: Efficient and Timely Encrypted Traffic Classification With ECHO

OpenCBD: A Network-Encrypted Unknown Traffic Identification Scheme Based on Open-Set Recognition

A Survey of Privacy-Preserving Techniques for Encrypted Traffic Inspection over Network Middleboxes

A Survey of HTTPS Traffic and Services Identification Approaches