Efficient and Transparent Method for Large-Scale TLS Traffic Analysis of Browsers and Analogous Programs
Many famous attacks take web browsers as transmission channels to make the target computer infected by malwares, such as watering hole and domain name hijacking. In order to protect the data transmission, the SSL/TLS protocol has been widely used to defeat various hijacking attacks. However, the exi...
Main Authors: | , , |
---|---|
Format: | Article |
Language: | English |
Published: |
Hindawi-Wiley
2019-01-01
|
Series: | Security and Communication Networks |
Online Access: | http://dx.doi.org/10.1155/2019/8467081 |
id |
doaj-42d49299a1a14c21ac525a13cb707cb6 |
---|---|
record_format |
Article |
spelling |
doaj-42d49299a1a14c21ac525a13cb707cb62020-11-25T02:05:18ZengHindawi-WileySecurity and Communication Networks1939-01141939-01222019-01-01201910.1155/2019/84670818467081Efficient and Transparent Method for Large-Scale TLS Traffic Analysis of Browsers and Analogous ProgramsJiaye Pan0Yi Zhuang1Binglin Sun2College of Computer Science and Technology, Nanjing University of Aeronautics and Astronautics, Nanjing 200016, ChinaCollege of Computer Science and Technology, Nanjing University of Aeronautics and Astronautics, Nanjing 200016, ChinaCollege of Computer Science and Technology, Nanjing University of Aeronautics and Astronautics, Nanjing 200016, ChinaMany famous attacks take web browsers as transmission channels to make the target computer infected by malwares, such as watering hole and domain name hijacking. In order to protect the data transmission, the SSL/TLS protocol has been widely used to defeat various hijacking attacks. However, the existence of such encryption protection makes the security software and devices confront with the difficulty of analyzing the encrypted malicious traffic at endpoints. In order to better solve this kind of situation, this paper proposes a new efficient and transparent method for large-scale automated TLS traffic analysis, named as hyper TLS traffic analysis (HTTA). It extracts multiple types of valuable data from the target system in the hyper mode and then correlates them to decrypt the network packets in real time, so that overall data correlation analysis can be performed on the target. Additionally, we propose an aided reverse engineering method to support the analysis, which can rapidly identify the target data in different versions of the program. The proposed method can be applied to the endpoints and cloud platforms; there are no trust risk of certificates and no influence on the target programs. Finally, the real experimental results show that the method is feasible and effective for the analysis, which leads to the lower runtime overhead compared with other methods. It covers all the popular browser programs with good adaptability and can be applied to the large-scale analysis.http://dx.doi.org/10.1155/2019/8467081 |
collection |
DOAJ |
language |
English |
format |
Article |
sources |
DOAJ |
author |
Jiaye Pan Yi Zhuang Binglin Sun |
spellingShingle |
Jiaye Pan Yi Zhuang Binglin Sun Efficient and Transparent Method for Large-Scale TLS Traffic Analysis of Browsers and Analogous Programs Security and Communication Networks |
author_facet |
Jiaye Pan Yi Zhuang Binglin Sun |
author_sort |
Jiaye Pan |
title |
Efficient and Transparent Method for Large-Scale TLS Traffic Analysis of Browsers and Analogous Programs |
title_short |
Efficient and Transparent Method for Large-Scale TLS Traffic Analysis of Browsers and Analogous Programs |
title_full |
Efficient and Transparent Method for Large-Scale TLS Traffic Analysis of Browsers and Analogous Programs |
title_fullStr |
Efficient and Transparent Method for Large-Scale TLS Traffic Analysis of Browsers and Analogous Programs |
title_full_unstemmed |
Efficient and Transparent Method for Large-Scale TLS Traffic Analysis of Browsers and Analogous Programs |
title_sort |
efficient and transparent method for large-scale tls traffic analysis of browsers and analogous programs |
publisher |
Hindawi-Wiley |
series |
Security and Communication Networks |
issn |
1939-0114 1939-0122 |
publishDate |
2019-01-01 |
description |
Many famous attacks take web browsers as transmission channels to make the target computer infected by malwares, such as watering hole and domain name hijacking. In order to protect the data transmission, the SSL/TLS protocol has been widely used to defeat various hijacking attacks. However, the existence of such encryption protection makes the security software and devices confront with the difficulty of analyzing the encrypted malicious traffic at endpoints. In order to better solve this kind of situation, this paper proposes a new efficient and transparent method for large-scale automated TLS traffic analysis, named as hyper TLS traffic analysis (HTTA). It extracts multiple types of valuable data from the target system in the hyper mode and then correlates them to decrypt the network packets in real time, so that overall data correlation analysis can be performed on the target. Additionally, we propose an aided reverse engineering method to support the analysis, which can rapidly identify the target data in different versions of the program. The proposed method can be applied to the endpoints and cloud platforms; there are no trust risk of certificates and no influence on the target programs. Finally, the real experimental results show that the method is feasible and effective for the analysis, which leads to the lower runtime overhead compared with other methods. It covers all the popular browser programs with good adaptability and can be applied to the large-scale analysis. |
url |
http://dx.doi.org/10.1155/2019/8467081 |
work_keys_str_mv |
AT jiayepan efficientandtransparentmethodforlargescaletlstrafficanalysisofbrowsersandanalogousprograms AT yizhuang efficientandtransparentmethodforlargescaletlstrafficanalysisofbrowsersandanalogousprograms AT binglinsun efficientandtransparentmethodforlargescaletlstrafficanalysisofbrowsersandanalogousprograms |
_version_ |
1724938972037120000 |