Introduction 2 Related work 3 The Multi-Level Framework 4 Evaluation Results 5 Conclusion & Future work 2 / 26 Based on French ISP, the amount of encrypted traffic represent almost 50% in 2015, compared with 5% in 2012. Despite SSL/TLS good intentions, it may be used for illegitimate purposes. The Issue An identification of HTTPS traffic without relying on decryption. Recent solutions: SSL certificate, SNI [1]→(Reliability issues). Research work: flow-based statistical method + Applicable to encrypted traffic.-Low accuracy and computation overhead issues.-Hard to get precise information from general statistics. 1 Used by commercial solution like FireEye & Forefront 4 / 26 Evaluation conditions: Full features set (42 features). RandomForest as ML algorithm. At least 100 connections number per service. K-Fold cross validation with k=10.

No abstract

Abstract. In this paper, we assess the protection mechanisms entered into recent clients to fight against the Sybil attack in KAD, a widely deployed Distributed Hash Table. We study three main mechanisms: a protection against flooding through packet tracking, an IP address limitation and a verification of identities. We evaluate their efficiency by designing and adapting an attack for several KAD clients with different levels of protection. Our results show that the new security rules mitigate the Sybil attacks previously launched. However, we prove that it is still possible to control a small part of the network despite the new inserted defenses with a distributed eclipse attack and limited resources.