Classification Research on SSL Encrypted Application

Fu, Peipei; Guo, Li; Xiong, Gang; Meng, Jiao

doi:10.1007/978-3-642-35795-4_51

Cited by 5 publications

(4 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Then, to decide whether the flow is a YouTube stream we use either the Service Name Indication (SNI) field in the Client Hello message (e.g. googlevideos.com) or machine learning techniques [20], [21]. Then we can remove audio packets; i.e., bursts below 400kB, since video traffic bursts are much larger.…”

Section: Preprocessingmentioning

confidence: 99%

Clustering the Unknown - The Youtube Case

Dvir

Marnerides

Dubin

et al. 2019

2019 International Conference on Computing, Networking and Communications (ICNC)

View full text Add to dashboard Cite

Recent stringent end-user security and privacy requirements caused the dramatic rise of encrypted video streams in which YouTube encrypted traffic is one of the most prevalent. Regardless of their encrypted nature, metadata derived from such traffic flows can be utilized to identify the title of a video, thus enabling the classification of video streams into a single video title using a given video title set. Nonetheless, scenarios where no video title set is present and a supervised approach is not feasible, are both frequent and challenging. In this paper we go beyond previous studies and demonstrate the feasibility of clustering unknown video streams into subgroups although no information is available about the title name. We address this problem by exploring Natural Language Processing (NLP) formulations and Word2vec techniques to compose a novel statistical feature in order to further cluster unknown video streams. Through our experimental results over real datasets we demonstrate that our methodology is capable to cluster 72 video titles out of 100 video titles from a dataset of 10,000 video streams. Thus, we argue that the proposed methodology could sufficiently contribute to the newly rising and demanding domain of encrypted Internet traffic classification.

show abstract

Section: Preprocessingmentioning

confidence: 99%

Clustering the Unknown - The Youtube Case

Dvir

Marnerides

Dubin

et al. 2019

2019 International Conference on Computing, Networking and Communications (ICNC)

View full text Add to dashboard Cite

show abstract

“…If the "googlevideos.com" string is found in the SNI, the flow is passed to the next module. Note that the YouTube flows identification can also be done using machine learning techniques [45,46].…”

Section: Preprocessingmentioning

confidence: 99%

I Know What You Saw Last Minute—Encrypted HTTP Adaptive Video Streaming Title Classification

Dubin

Dvir

Pele

et al. 2017

IEEE Trans.Inform.Forensic Secur.

View full text Add to dashboard Cite

Desktops and laptops can be maliciously exploited to violate privacy. There are two main types of attack scenarios: active and passive. In this paper, we consider the passive scenario where the adversary does not interact actively with the device, but he is able to eavesdrop on the network traffic of the device from the network side. Most of the Internet traffic is encrypted and thus passive attacks are challenging. Previous research has shown that information can be extracted from encrypted multimedia streams. This includes video title classification of non HTTP adaptive streams (non-HAS). This paper presents an algorithm for encrypted HTTP adaptive video streaming title clas- sification. We show that an external attacker can identify the video title from video HTTP adaptive streams (HAS) sites such as YouTube. To the best of our knowledge, this is the first work that shows this. We provide a large data set of 10000 YouTube video streams of 100 popular video titles (each title downloaded 100 times) as examples for this task. The dataset was collected under real-world network conditions. We present several machine algorithms for the task and run a through set of experiments, which shows that our classification accuracy is more than 95%. We also show that our algorithms are able to classify video titles that are not in the training set as unknown and some of the algorithms are also able to eliminate false prediction of video titles and instead report unknown. Finally, we evaluate our algorithms robustness to delays and packet losses at test time and show that a solution that uses SVM is the most robust against these changes given enough training data. We provide the dataset and the crawler for future research.

show abstract

“…In addition, Barati et al (2013) proposed a feature selection IDS in Encrypted Traffic Using Genetic Algorithm (GA). SSL traffic classification in Google traffic was proposed by Fu et al (2013) using C4.5 algorithm. Furthermore, considering harmonic mean as distance metric in clustering approach was implemented by Zhang et al (2013) to classify real-world encrypted traffic.…”

Section: Fig1 Ssh Brute Force Attackmentioning

confidence: 99%

Intrusion Detection System in Secure Shell Traffic in Cloud Environment

Barati¹,

Abdullah²,

Udzir³

et al. 2014

Journal of Computer Science

View full text Add to dashboard Cite

Due to growth of Cloud computing usage, the need to apply encrypted protocols to provide confidentiality and integrity of data increases dramatically. Attacker can take advantage of these protocols to hide the intrusion and evade detection. Many traditional attack detection techniques have been proposed to provide security in the networks but none of them can be implemented properly in encrypted networks. This study investigates a popular attack in Secure Shell (SSH), known as brute force attack and provides an efficient method to detect this attack. Brute force attack is launched by implementing a client-server SSH model in a private Cloud environment and the traffics regarding attack and normal are captured on the server. Then, representative features of traffic are extracted and used by the Multi-Layer Perceptron model of Artificial Neural Network to classify the attack and normal traffic. Results gained by this method show that the proposed model is successfully capable to detect this attack with high accuracy and low false alarm.

show abstract

Classification Research on SSL Encrypted Application

Cited by 5 publications

References 9 publications

Clustering the Unknown - The Youtube Case

Clustering the Unknown - The Youtube Case

I Know What You Saw Last Minute—Encrypted HTTP Adaptive Video Streaming Title Classification

Intrusion Detection System in Secure Shell Traffic in Cloud Environment

Contact Info

Product

Resources

About