Categorizing TLS traffic based on JA3 pre-hash values

Tietueen suppeat tiedot
dc.contributor.authorHeino Jenny
dc.contributor.authorHakkala Antti
dc.contributor.authorVirtanen Seppo
dc.contributor.organizationfi=kyberturvallisuusteknologia|en=Cyber Security Engineering|
dc.contributor.organizationfi=tietotekniikan laitos|en=Department of Computing|
dc.contributor.organization-code1.2.246.10.2458963.20.28753843706
dc.contributor.organization-code1.2.246.10.2458963.20.85312822902
dc.converis.publication-id179257961
dc.converis.urlhttps://research.utu.fi/converis/portal/Publication/179257961
dc.date.accessioned2025-08-27T22:46:59Z
dc.date.available2025-08-27T22:46:59Z
dc.description.abstract<p> The JA3 algorithm for fingerprinting TLS client traffic has become a popular additional tool in the tool set of network security professionals. The pre-hash value of the JA3 fingerprint lists parameter values from the TLS handshake supported by the TLS client. In this paper we present two different machine learning methods for identifying the endpoint application from TLS traffic based on the JA3 pre-hash string. Both methods were able to identify applications from Mozilla in our sample set, but had more variation with other applications. The methods can be used for improving network security accuracy. <br></p>
dc.format.pagerange101
dc.format.pagerange94
dc.identifier.jour-issn1877-0509
dc.identifier.olddbid202797
dc.identifier.oldhandle10024/185824
dc.identifier.urihttps://www.utupub.fi/handle/11111/48836
dc.identifier.urlhttps://doi.org/10.1016/j.procs.2023.03.015
dc.identifier.urnURN:NBN:fi-fe2023042037766
dc.language.isoen
dc.okm.affiliatedauthorHeino, Jenny
dc.okm.affiliatedauthorHakkala, Antti
dc.okm.affiliatedauthorVirtanen, Seppo
dc.okm.discipline113 Computer and information sciencesen_GB
dc.okm.discipline213 Electronic, automation and communications engineering, electronicsen_GB
dc.okm.discipline222 Other engineering and technologiesen_GB
dc.okm.discipline113 Tietojenkäsittely ja informaatiotieteetfi_FI
dc.okm.discipline213 Sähkö-, automaatio- ja tietoliikennetekniikka, elektroniikkafi_FI
dc.okm.discipline222 Muu tekniikkafi_FI
dc.okm.internationalcopublicationnot an international co-publication
dc.okm.internationalityInternational publication
dc.okm.typeA4 Conference Article
dc.publisher.countryNetherlandsen_GB
dc.publisher.countryAlankomaatfi_FI
dc.publisher.country-codeNL
dc.relation.conferenceInternational Conference on Ambient Systems, Networks and Technologies Networks
dc.relation.doi10.1016/j.procs.2023.03.015
dc.relation.ispartofjournalProcedia Computer Science
dc.relation.ispartofseriesProcedia Computer Science
dc.relation.volume220
dc.source.identifierhttps://www.utupub.fi/handle/10024/185824
dc.titleCategorizing TLS traffic based on JA3 pre-hash values
dc.title.bookThe 14th International Conference on Ambient Systems, Networks and Technologies Networks (ANT 2022) and The 6th International Conference on Emerging Data and Industry 4.0 (EDI40)
dc.year.issued2023

Tiedostot

Näytetään 1 - 1 / 1
Name:
1-s2.0-S1877050923005501-main.pdf
Size:
646.82 KB
Format:
Adobe Portable Document Format
Lataa

Kokoelmat

Rinnakkaistallenteet