We gratefully acknowledge support from
the Simons Foundation and member institutions.
Full-text links:

Download:

Current browse context:

cs.CR

Change to browse by:

cs

References & Citations

DBLP - CS Bibliography

Bookmark

(what is this?)
CiteULike logo BibSonomy logo Mendeley logo del.icio.us logo Digg logo Reddit logo ScienceWISE logo

Computer Science > Cryptography and Security

Title: HTTPS Event-Flow Correlation: Improving Situational Awareness in Encrypted Web Traffic

Abstract: Achieving situational awareness is a challenging process in current HTTPS-dominant web traffic. In this paper, we propose a new approach to encrypted web traffic monitoring. First, we design a method for correlating host-based and network monitoring data based on their common features and a correlation time-window. Then we analyze the correlation results in detail to identify configurations of web servers and monitoring infrastructure that negatively affect the correlation. We describe these properties and possible data preprocessing techniques to minimize their impact on correlation performance. Furthermore, to test the correlation method's behavior in different web server setups and for recent encryption protocols, we modify it by adapting the correlation features to TLS 1.3 and QUIC. Finally, we evaluate the correlation method on a dataset collected from a campus network. The results show that while the correlation requires monitoring of custom event and flow features, it remains feasible even when using encryption protocols designed for the near future.
Comments: 6 pages
Subjects: Cryptography and Security (cs.CR)
DOI: 10.1109/NOMS54207.2022.9789877
Cite as: arXiv:2206.11175 [cs.CR]
  (or arXiv:2206.11175v1 [cs.CR] for this version)

Submission history

From: Stanislav Spacek [view email]
[v1] Wed, 22 Jun 2022 15:32:28 GMT (198kb,D)

Link back to: arXiv, form interface, contact.