Encrypted Network Traffic Analysis (SpringerBriefs in Computer Science)

✍ Scribed by Aswani Kumar Cherukuri, Sumaiya Thaseen Ikram, Gang Li, Xiao Liu

• Publisher: Springer
• Year: 2024
• Tongue: English
• Leaves: 108
• Edition: 2024
• Category: Library

✦ Synopsis

This book provides a detailed study on sources of encrypted network traffic, methods and techniques for analyzing, classifying and detecting the encrypted traffic. The authors provide research findings and objectives in the first 5 chapters, on encrypted network traffic, protocols and applications of the encrypted network traffic. The authors also analyze the challenges and issues with encrypted network traffic. It systematically introduces the analysis and classification of encrypted traffic and methods in detecting the anomalies in encrypted traffic. The effects of traditional approaches of encrypted traffic, such as deep packet inspection and flow based approaches on various encrypted traffic applications for identifying attacks is discussed as well. This book presents intelligent techniques for analyzing the encrypted network traffic and includes case studies.

The first chapter also provides fundamentals of network traffic analysis, anomalies in the network traffic, protocols for encrypted network traffic. The second chapter presents an overview of the challenges and issues with encrypted network traffic and the new threat vectors introduced by the encrypted network traffic. Chapter 3 provides details analyzing the encrypted network traffic and classification of various kinds of encrypted network traffic. Chapter 4 discusses techniques for detecting attacks against encrypted protocols and chapter 5 analyzes AI based approaches for anomaly detection.

Researchers and professionals working in the related field of Encrypted Network Traffic will purchase this book as a reference. Advanced-level students majoring in computer science will also find this book to be a valuable resource.

✦ Table of Contents

Foreword
Preface
Acknowledgements
Contents
Chapter 1: Introduction
1.1 Security in TCP/IP
1.2 Security at the Network Layer
1.3 Security at Transport Layer
1.4 Security at Application Layer
1.5 Security Implementations in Other TCP/IP Networks
1.6 Network Traffic Analysis
1.7 Challenges Involved in Network Traffic Analysis
1.8 Conclusions
References
Chapter 2: Encrypted Network Traffic Analysis
2.1 Introduction
2.2 ENTA Methodology
2.3 Purpose of the Analysis
2.4 Collection of Traffic Data and Preprocessing
2.5 Feature Selection and Extraction
2.5.1 Packet-Based Features
2.5.1.1 Flow-Based Features
2.5.2 Session-Based Features
2.5.3 Host-Based Features
2.6 Techniques for ENTA
2.7 Conclusions
References
Chapter 3: Classification of Encrypted Network Traffic
3.1 Introduction
3.2 Methods for Encrypted Traffic Classification
3.2.1 Port-Based Approach
3.2.2 Deep Packet Inspection
3.2.3 Time-Based Features
3.2.4 Single and Multiple Flow-Based Approaches
3.3 Traffic Preprocessing
3.4 Encrypted Application Traffic Classification
3.5 Conclusion
References
Chapter 4: Detection of Anomalous Encrypted Traffic
4.1 Introduction
4.2 Detecting Attacks Against Encrypted Protocols
4.3 Tracing Back Attackers Against Encrypted Protocols
4.4 Detection and Traceback Schemes
4.4.1 Envisioned Attacks
4.4.2 Network Topology
4.4.3 DTRAB Learning Stage
4.4.4 DTRAB Detection Stage
4.4.5 DTRAB Alert Stage
4.4.6 DTRAB Traceback Phase
4.5 Performance Analysis
4.5.1 Highly Collaborative Attack Detection
4.5.2 Detection Accuracy
4.6 Traceback Scheme Performance
4.6.1 Tracing Back Multiple Attackers
4.6.2 Investigating the Convergence Point Influence
4.7 Conclusion
References
Chapter 5: Artificial Intelligence-Based Approaches for Anomaly Detection
5.1 Introduction
5.2 Machine Learning-Based Approaches for Encrypted Traffic Analysis
5.2.1 Attribute-Based Analysis
5.2.1.1 Packet Size and Inter-Arrival Time (IAT)
5.2.1.2 Burst Size-Surge Duration
5.3 Deep Learning-Based Approaches for Encrypted Traffic Analysis
5.3.1 Data Preprocessing
5.3.2 Traffic Attributes
5.3.3 Models
5.3.3.1 MLP
5.3.3.2 CNN
5.3.3.3 SAE
5.3.3.4 VAE
5.3.3.5 Denoising Auto Encoder (DAE)
5.3.3.6 GAN
5.4 Proposed Model for Darknet Traffic Classification
5.5 Proposed XAI Model
5.5.1 Background
5.5.2 Methodology
5.5.3 Control Case Model Building
5.5.4 Light Gradient Boosting
5.6 Discussion
5.7 Conclusion
References