CAREER:Towards Effective Identification of Application Behaviors in Encrypted Traffic

点击翻译按钮获取中文摘要

Fabian MonroseJohn Hopkins Unversity0546350AbstractSeveral fundamental security mechanisms for restricting access tonetwork resources rely on the ability of a reference monitor toinspect the contents of traffic as it traverses the network. However,with the increasing popularity of cryptographic protocols thetraditional means of inspecting packet contents to enforce securitypolicies is no longer a viable approach as message contents areconcealed by encryption. This project encompasses the first majorcomponent of a principled investigation into the feasibility ofprotocol identification based solely on those features that remainintact after encryption---namely, the packet size, inter-arrival anddirection. More specifically, this work attempts to provide a betterunderstanding of the limits of protocol recognition based on athorough statistical analysis and information theoretic assessment ofthe available features in protocol behaviors observed in thewild. Specifically, this project advances the current state of the artand contributes to the scientific community by building efficientmixture models for detecting protocols with multi-modal behaviors,designing practical tools for visualizing behavioral motifs in TCPsequences, providing new information-theoretic decision policies forassigning protocol class labels to these sequences, and imparting newnotions for assessing realistic masquerading attacks and theappropriate defenses.