SSH Traffic Identification Using EM Clustering

The SSL/TLS, one of the most popular encryption protocol, was developed as a solution of various network security problem while the network traffic has become complex and diverse. But the SSL/TLS traffic has been identified as its protocol name, not its used services, which is required for the effective network traffic management. This paper proposes a new method to generate service signatures automatically from SSL/TLS payload data and to classify network traffic in accordance with their application services. We utilize the certificate publication information field in the certificate exchanging record of SSL/TLS traffic for the service signatures, which occurs when SSL/TLS performs Handshaking before encrypt transmission. We proved the performance and feasibility of the proposed method by experimental result that classify about 95% SSL/TLS traffic with 95% accuracy for every SSL/TLS services.

show abstract

SSH Traffic Identification Using EM Clustering

Cited by 2 publications

References 12 publications

A method for service identification of SSL/TLS encrypted traffic with the relation of session ID and Server IP

A method for service identification of SSL/TLS encrypted traffic with the relation of session ID and Server IP

Service Identification Method for Encrypted Traffic Based on SSL/TLS

Contact Info

Product

Resources

About