Towards Identification of Network Applications in Encrypted Traffic

Network traffic monitoring for security threat detection and network performance
management is challenging because most communications are protected by
encryption. This paper addresses the problem of identifying applications
associated with Transport Layer Security (TLS) network connections. We evaluate
three primary approaches to classifying TLS traffic: fingerprinting methods,
SNI-based identification, and machine learning based classifiers. Each method has
strengths and limitations: fingerprinting relies on a regularly updated database
of known hashes, SNI is vulnerable to obfuscation or missing information, and an
AI technique such as machine learning requires sufficient labelled training data.
To support research in this area, we have also created a novel dataset of
labelled TLS communications for popular desktop and mobile applications. The
comparison of these methods that we present highlights the challenges of
identifying individual applications, as TLS properties are significantly shared
across applications. The simpler task of identifying a collection of candidate
applications still provides valuable insights for network monitoring and can be
achieved with high accuracy by all methods considered. Finally, we suggest
practical use cases and identify future research directions to further improve
application identification methods.