HTTPS Traffic Analysis and Client Identification Using Passive
SSL/TLS Fingerprinting

J 2016

HTTPS Traffic Analysis and Client Identification Using Passive SSL/TLS Fingerprinting

HUSÁK, Martin; Milan ČERMÁK; Tomáš JIRSÍK a Pavel ČELEDA

Základní údaje

Originální název

HTTPS Traffic Analysis and Client Identification Using Passive SSL/TLS Fingerprinting

Autoři

HUSÁK, Martin ; Milan ČERMÁK; Tomáš JIRSÍK a Pavel ČELEDA

Vydání

EURASIP Journal on Information Security, 2016, 2510-523X

Další údaje

Jazyk

angličtina

Typ výsledku

Článek v odborném periodiku

Obor

10201 Computer sciences, information science, bioinformatics

Stát vydavatele

Německo

Utajení

není předmětem státního či obchodního tajemství

Odkazy

URL

Označené pro přenos do RIV

Ano

Kód RIV

RIV/00216224:14610/16:00089221

Organizační jednotka

Ústav výpočetní techniky

Klíčová slova anglicky

Network monitoring;HTTPS;User-Agent;SSL;TLS;Fingerprinting

Štítky

best, best2, rivok

Příznaky

Mezinárodní význam, Recenzováno

Změněno: 18. 4. 2019 15:31, Mgr. Alena Mokrá

Anotace

V originále

The encryption of network traffic complicates legitimate network monitoring, traffic analysis, and network forensics. In this paper, we present real-time lightweight identification of HTTPS clients based on network monitoring and SSL/TLS fingerprinting. Our experiment shows that it is possible to estimate the User-Agent of a client in HTTPS communication via the analysis of the SSL/TLS handshake. The fingerprints of SSL/TLS handshakes, including a list of supported cipher suites, differ among clients and correlate to User-Agent values from a HTTP header. We built up a dictionary of SSL/TLS cipher suite lists and HTTP User-Agents and assigned the User-Agents to the observed SSL/TLS connections to identify communicating clients. The dictionary was used to classify live HTTPS network traffic. We were able to retrieve client types from 95.4 % of HTTPS network traffic. Further, we discussed host-based and network-based methods of dictionary retrieval and estimated the quality of the data.

Přiložené soubory

dataset-https_client_identification.zip

Citovat

HUSÁK, Martin; Milan ČERMÁK; Tomáš JIRSÍK a Pavel ČELEDA. HTTPS Traffic Analysis and Client Identification Using Passive SSL/TLS Fingerprinting. EURASIP Journal on Information Security. 2016, roč. 2016, č. 1, s. 1-14. ISSN 2510-523X. Dostupné z: https://doi.org/10.1186/s13635-016-0030-7.

@article{1321931,
   author = {Husák, Martin and Čermák, Milan and Jirsík, Tomáš and Čeleda, Pavel},
   article_number = {1},
   doi = {https://doi.org/10.1186/s13635-016-0030-7},
   keywords = {Network monitoring;HTTPS;User-Agent;SSL;TLS;Fingerprinting},
   language = {eng},
   issn = {2510-523X},
   journal = {EURASIP Journal on Information Security},
   title = {HTTPS Traffic Analysis and Client Identification Using Passive SSL/TLS Fingerprinting},
   url = {https://link.springer.com/article/10.1186/s13635-016-0030-7},
   volume = {2016},
   year = {2016}
}

TY  - JOUR
ID  - 1321931
AU  - Husák, Martin - Čermák, Milan - Jirsík, Tomáš - Čeleda, Pavel
PY  - 2016
TI  - HTTPS Traffic Analysis and Client Identification Using Passive SSL/TLS Fingerprinting
JF  - EURASIP Journal on Information Security
VL  - 2016
IS  - 1
SP  - 1-14
EP  - 1-14
SN  - 2510523X
KW  - Network monitoring;HTTPS;User-Agent;SSL;TLS;Fingerprinting
UR  - https://link.springer.com/article/10.1186/s13635-016-0030-7
L2  - https://link.springer.com/article/10.1186/s13635-016-0030-7
N2  - The encryption of network traffic complicates legitimate network monitoring, traffic analysis, and network forensics. In this paper, we present real-time lightweight identification of HTTPS clients based on network monitoring and SSL/TLS fingerprinting. Our experiment shows that it is possible to estimate the User-Agent of a client in HTTPS communication via the analysis of the SSL/TLS handshake. The fingerprints of SSL/TLS handshakes, including a list of supported cipher suites, differ among clients and correlate to User-Agent values from a HTTP header. We built up a dictionary of SSL/TLS cipher suite lists and HTTP User-Agents and assigned the User-Agents to the observed SSL/TLS connections to identify communicating clients. The dictionary was used to classify live HTTPS network traffic. We were able to retrieve client types from 95.4 % of HTTPS network traffic. Further, we discussed host-based and network-based methods of dictionary retrieval and estimated the quality of the data.
ER  -

HUSÁK, Martin; Milan ČERMÁK; Tomáš JIRSÍK a Pavel ČELEDA. HTTPS Traffic Analysis and Client Identification Using Passive SSL/TLS Fingerprinting. \textit{EURASIP Journal on Information Security}. 2016, roč.~2016, č.~1, s.~1-14. ISSN~2510-523X. Dostupné z: https://doi.org/10.1186/s13635-016-0030-7.

Přehled o publikaci