Towards Identification of Network Applications in Encrypted Traffic

Network traffic monitoring for security threat detection and network performance
management is challenging because most communications are protected by
encryption. This paper addresses the problem of identifying applications
associated with Transport Layer Security (TLS) network connections.
We evaluate three primary approaches to classifying TLS traffic: fingerprinting
methods, SNI-based identification, and machine learning based classifiers. Each
method has strengths and limitations: fingerprinting relies on a regularly
updated database of known hashes, SNI is vulnerable to obfuscation or missing
information, and an AI technique such as machine learning requires sufficient
labelled training data. To support research in this area, we have also created
a novel dataset of labelled TLS communications for popular desktop and mobile
applications.
The comparison of these methods that we present highlights the challenges of
identifying individual applications, as TLS properties are significantly shared
across applications. The simpler task of identifying a collection of candidate
applications still provides valuable insights for network monitoring and can be
achieved with high accuracy by all methods considered. Finally, we suggest
practical use cases and identify future research directions to further improve
application identification methods.