A4 Refereed article in a conference publication
Categorizing TLS traffic based on JA3 pre-hash values
Authors: Heino Jenny, Hakkala Antti, Virtanen Seppo
Editors: Shakshuki Elhadi
Conference name: International Conference on Ambient Systems, Networks and Technologies Networks
Publication year: 2023
Journal: Procedia Computer Science
Book title : The 14th International Conference on Ambient Systems, Networks and Technologies Networks (ANT 2022) and The 6th International Conference on Emerging Data and Industry 4.0 (EDI40)
Series title: Procedia Computer Science
Volume: 220
First page : 94
Last page: 101
eISSN: 1877-0509
DOI: https://doi.org/10.1016/j.procs.2023.03.015
Web address : https://doi.org/10.1016/j.procs.2023.03.015
Self-archived copy’s web address: https://research.utu.fi/converis/portal/detail/Publication/179257961
The JA3 algorithm for fingerprinting TLS client traffic has become a popular additional tool in the tool set of network security professionals. The pre-hash value of the JA3 fingerprint lists parameter values from the TLS handshake supported by the TLS client. In this paper we present two different machine learning methods for identifying the endpoint application from TLS traffic based on the JA3 pre-hash string. Both methods were able to identify applications from Mozilla in our sample set, but had more variation with other applications. The methods can be used for improving network security accuracy.
Downloadable publication This is an electronic reprint of the original article. |  |
