Event-Flow Correlation for Anomaly Detection in HTTP/3 Web Traffic

Investor logo
Investor logo

Warning

This publication doesn't include Faculty of Arts. It includes Institute of Computer Science. Official publication website can be found on muni.cz.
Authors

ŠPAČEK Stanislav VELAN Petr HOLKOVIČ Martin PLESNÍK Tomáš

Year of publication 2023
Type Article in Proceedings
Conference 2023 IEEE/IFIP Network Operations and Management Symposium (NOMS 2023)
MU Faculty or unit

Institute of Computer Science

Citation
Web https://ieeexplore.ieee.org/document/10154211
Doi http://dx.doi.org/10.1109/NOMS56928.2023.10154211
Keywords Network flow monitoring; host-based monitoring; event; flow; event-flow correlation; HTTP/3
Attached files
Description The new HTTP/3 protocol for web traffic was recently released, superseding the widely used HTTP/2. It now supports exclusively encrypted transmissions and brings a lot of other changes. Many of these changes promote user privacy but hinder security monitoring of network traffic. In the past, the direct correlation of events and flows generated by the HTTP/2 web traffic enriched the encrypted network flows with the content from the web server's event log. In this paper, we modify the event-flow correlation method for the HTTP/3 protocol. Then, we deploy and evaluate the correlation method on a real traffic dataset. We compare the results of the correlation with the results for HTTP/2 and discuss the differences in the correlation of the new protocol compared to the original one. The results show that event-flow correlation can still enrich HTTP/3 network flows, albeit it introduces new challenges to cope with.
Related projects:

You are running an old browser version. We recommend updating your browser to its latest version.