CAREER:Towards Effective Identification of Application Behaviors in Encrypted Traffic

限制网络资源访问的几个基本安全机制依赖于参考监视器在网络中检查流量内容的能力。然而，随着加密协议的日益普及，传统的检测数据包内容来执行安全策略的方法不再是一种可行的方法，因为消息内容被加密所隐藏。该项目包含了对协议识别可行性的原则性研究的第一个主要部分，该可行性研究仅基于加密后保持不变的那些特征——即数据包大小、到达间和方向。更具体地说，这项工作试图更好地理解协议识别的局限性，这是基于对在野外观察到的协议行为中可用特征的彻底统计分析和信息论评估。具体来说，该项目通过构建有效的混合模型来检测具有多模态行为的协议，设计实用的工具来可视化tcpsequence中的行为基元，为为这些序列分配协议类标签提供新的信息论决策策略，并为评估现实伪装攻击和适当防御提供新概念，从而推进了当前的艺术状态，并为科学界做出了贡献。

Fabian MonroseJohn Hopkins Unversity0546350AbstractSeveral fundamental security mechanisms for restricting access tonetwork resources rely on the ability of a reference monitor toinspect the contents of traffic as it traverses the network. However,with the increasing popularity of cryptographic protocols thetraditional means of inspecting packet contents to enforce securitypolicies is no longer a viable approach as message contents areconcealed by encryption. This project encompasses the first majorcomponent of a principled investigation into the feasibility ofprotocol identification based solely on those features that remainintact after encryption---namely, the packet size, inter-arrival anddirection. More specifically, this work attempts to provide a betterunderstanding of the limits of protocol recognition based on athorough statistical analysis and information theoretic assessment ofthe available features in protocol behaviors observed in thewild. Specifically, this project advances the current state of the artand contributes to the scientific community by building efficientmixture models for detecting protocols with multi-modal behaviors,designing practical tools for visualizing behavioral motifs in TCPsequences, providing new information-theoretic decision policies forassigning protocol class labels to these sequences, and imparting newnotions for assessing realistic masquerading attacks and theappropriate defenses.