Logo des Repositoriums
 

Network forensic of partial SSL/TLS encrypted traffic classification using clustering-algorithms

dc.contributor.authorWu, Meng-Da
dc.contributor.authorWolthusen, Stephen D.
dc.contributor.editorGöbel, Oliver
dc.contributor.editorFrings, Sandra
dc.contributor.editorGünther, Detlef
dc.contributor.editorNedon, Jens
dc.contributor.editorSchadt, Dirk
dc.date.accessioned2019-06-04T11:30:42Z
dc.date.available2019-06-04T11:30:42Z
dc.date.issued2008
dc.description.abstractMachine learning tools have long been used in network traffic analysis, but their application to the network forensics domain and ist specific issues has been limited thus far. We investigate the applicability of several common machine learning techniques to identify and classify partial encrypted traffic as may be encountered by forensic investigators confronted only with partial post-hoc traces. Is is highly desirable to identify the types of applications and endpoints using such tunnels to faciliate further forensic investigation. In this paper, we therefore examine several clustering algorithms, namely DBSCAN (Density-Based Spatial Clustering of Application with Noise), K-means, and EM (Expectation-Maximization) with regard to their ability to classify encrypted partial traffic using inter-arrival time and TCP lenght information chosen for its predictive significance. Our experiments demonstrate promising classifiction results.en
dc.identifier.isbn978-3-88579-234-5
dc.identifier.pissn1617-5468
dc.identifier.urihttps://dl.gi.de/handle/20.500.12116/23590
dc.language.isoen
dc.publisherGesellschaft für Informatik e.V.
dc.relation.ispartofIMF 2008 – IT Incident Management & IT Forensics
dc.relation.ispartofseriesLecture Notes in Informatics (LNI) - Proceedings, Volume P-140
dc.titleNetwork forensic of partial SSL/TLS encrypted traffic classification using clustering-algorithmsen
dc.typeText/Conference Paper
gi.citation.endPage172
gi.citation.publisherPlaceBonn
gi.citation.startPage157
gi.conference.dateSeptember, 23-25, 2008
gi.conference.locationMannheim
gi.conference.sessiontitleRegular Research Papers

Dateien

Originalbündel
1 - 1 von 1
Lade...
Vorschaubild
Name:
gi-proc-140-012.pdf
Größe:
248.86 KB
Format:
Adobe Portable Document Format