HTTPS Event-Flow Correlation: Improving Situational Awareness in Encrypted Web Traffic

Investor logo
Investor logo

Warning

This publication doesn't include Faculty of Arts. It includes Institute of Computer Science. Official publication website can be found on muni.cz.
Authors

ŠPAČEK Stanislav VELAN Petr ČELEDA Pavel TOVARŇÁK Daniel

Year of publication 2022
Type Article in Proceedings
Conference 2022 IEEE/IFIP Network Operations and Management Symposium (NOMS 2022)
MU Faculty or unit

Institute of Computer Science

Citation
Web https://ieeexplore.ieee.org/document/9789877
Doi http://dx.doi.org/10.1109/NOMS54207.2022.9789877
Keywords Network flow monitoring; host-based monitoring; event; flow; event-flow correlation; HTTPS; TLS; QUIC
Attached files
Description Achieving situational awareness is a challenging process in current HTTPS-dominant web traffic. In this paper, we propose a new approach to encrypted web traffic monitoring. First, we design a method for correlating host-based and network monitoring data based on their common features and a correlation time-window. Then we analyze the correlation results in detail to identify configurations of web servers and monitoring infrastructure that negatively affect the correlation. We describe these properties and possible data preprocessing techniques to minimize their impact on correlation performance. Furthermore, to test the correlation method's behavior in different web server setups and for recent encryption protocols, we modify it by adapting the correlation features to TLS 1.3 and QUIC. Finally, we evaluate the correlation method on a dataset collected from a campus network. The results show that while the correlation requires monitoring of custom event and flow features, it remains feasible even when using encryption protocols designed for the near future.
Related projects:

You are running an old browser version. We recommend updating your browser to its latest version.