On Inferring Application Protocol Behaviors in Encrypted Network Traffic

Several fundamental security mechanisms for restricting access to network resources rely on the ability of a reference monitor to inspect the contents of traffic as it traverses the network. However, with the increasing popularity of cryptographic protocols, the traditional means of inspecting packet contents to enforce security policies is no longer a viable approach as message contents are concealed by encryption. In this paper, we investigate the extent to which common application protocols can be identified using only the features that remain intact after encryption--namely packet size, timing, and direction. We first present what we believe to be the first exploratory look at protocol identification in encrypted tunnels which carry traffic from many TCP connections simultaneously, using only post-encryption observable features. We then explore the problem of protocol identification in individual encrypted TCP connections, using much less data than in other recent approaches. The ...

• Type: Journal
• Year: 2006
• Where: JMLR
• Authors: Charles V. Wright, Fabian Monrose, Gerald M. Masson
• Keywords: JMLR 2006, Protocol Identification, Several Fundamental Security, TCP Connections