A survey of methods for encrypted network traffic fingerprinting

Area of Science:

• Computer Science
• Network Security
• Cryptography

Background:

• Increasing reliance on encrypted communication protocols like TLS necessitates robust security measures.
• Traditional network fingerprinting methods face challenges with modern cloud and software-defined networks.
• Decryption of encrypted traffic poses privacy risks and incurs significant costs.

Purpose of the Study:

• To investigate and analyze Transport Layer Security (TLS) fingerprinting as an alternative to traditional network analysis.
• To evaluate TLS fingerprinting's effectiveness in classifying encrypted traffic without decryption.
• To address the limitations of existing fingerprinting techniques in contemporary network environments.

Main Methods:

• Analysis of TLS fingerprinting techniques, categorized into fingerprint collection and artificial intelligence (AI)-based methods.
• Detailed examination of fingerprint collection approaches, including ClientHello/ServerHello messages, handshake state transitions, and client responses.
• Exploration of AI-based techniques, focusing on statistical, time series, and graph-based feature engineering.

Main Results:

• TLS fingerprinting provides a viable method for analyzing encrypted traffic without compromising privacy.
• Both fingerprint collection and AI-based techniques offer distinct advantages and disadvantages for traffic classification.
• Hybrid approaches combining fingerprint collection with AI show promise for enhanced analysis.

Conclusions:

• Effective utilization of TLS fingerprinting requires a systematic approach to analyzing and controlling cryptographic traffic.
• A blueprint for step-by-step analysis and control studies is proposed to optimize TLS fingerprinting techniques.
• TLS fingerprinting represents a significant advancement in network security for analyzing encrypted communications.