Event-Flow Correlation for Anomaly Detection in HTTP/3 Web Traffic

Logo poskytovatele
Logo poskytovatele

Varování

Publikace nespadá pod Pedagogickou fakultu, ale pod Ústav výpočetní techniky. Oficiální stránka publikace je na webu muni.cz.
Autoři

ŠPAČEK Stanislav VELAN Petr HOLKOVIČ Martin PLESNÍK Tomáš

Rok publikování 2023
Druh Článek ve sborníku
Konference 2023 IEEE/IFIP Network Operations and Management Symposium (NOMS 2023)
Fakulta / Pracoviště MU

Ústav výpočetní techniky

Citace
www https://ieeexplore.ieee.org/document/10154211
Doi http://dx.doi.org/10.1109/NOMS56928.2023.10154211
Klíčová slova Network flow monitoring; host-based monitoring; event; flow; event-flow correlation; HTTP/3
Přiložené soubory
Popis The new HTTP/3 protocol for web traffic was recently released, superseding the widely used HTTP/2. It now supports exclusively encrypted transmissions and brings a lot of other changes. Many of these changes promote user privacy but hinder security monitoring of network traffic. In the past, the direct correlation of events and flows generated by the HTTP/2 web traffic enriched the encrypted network flows with the content from the web server's event log. In this paper, we modify the event-flow correlation method for the HTTP/3 protocol. Then, we deploy and evaluate the correlation method on a real traffic dataset. We compare the results of the correlation with the results for HTTP/2 and discuss the differences in the correlation of the new protocol compared to the original one. The results show that event-flow correlation can still enrich HTTP/3 network flows, albeit it introduces new challenges to cope with.
Související projekty:

Používáte starou verzi internetového prohlížeče. Doporučujeme aktualizovat Váš prohlížeč na nejnovější verzi.