论文标题
使用目的地上下文和知识库进行准确的TLS指纹打印
Accurate TLS Fingerprinting using Destination Context and Knowledge Bases
论文作者
论文摘要
网络指纹用于识别应用程序，提供有关网络流量的洞察力并检测恶意活动。随着TL的广泛采用，依靠清晰文本数据的传统指纹技术不再可行。已经引入了特定于TLS特定的技术，该技术从Client_hello中精心选择的数据功能中创建一个指纹字符串，以在交换数据之前促进过程识别。不幸的是，这种方法在实践中失败了，因为数百个过程可以映射到相同的指纹字符串。我们通过提出一个TLS指纹系统来解决此问题，该系统除了精心构造的指纹字符串外，还使用目标地址，端口和服务器名称。目标上下文用于消除通过应用加权幼稚的贝叶斯分类器来匹配指纹字符串的一组过程，从而导致性能要大得多。
Network fingerprinting is used to identify applications, provide insight into network traffic, and detect malicious activity. With the broad adoption of TLS, traditional fingerprinting techniques that rely on clear-text data are no longer viable. TLS-specific techniques have been introduced that create a fingerprint string from carefully selected data features in the client_hello to facilitate process identification before data is exchanged. Unfortunately, this approach fails in practice because hundreds of processes can map to the same fingerprint string. We solve this problem by presenting a TLS fingerprinting system that makes use of the destination address, port, and server name in addition to a carefully constructed fingerprint string. The destination context is used to disambiguate the set of processes that match a fingerprint string by applying a weighted naive Bayes classifier, resulting in far greater performance.
