Skip to Main content Skip to Navigation
Theses

Analyse de trafic HTTPS pour la supervision d'activités utilisateurs

Pierre-Olivier Brissaud 1
1 RESIST - Resilience and Elasticity for Security and ScalabiliTy of dynamic networked systems
Inria Nancy - Grand Est, LORIA - NSS - Department of Networks, Systems and Services
Abstract : The protection of the Internet users’ privacy has made every web service offer some security by using encryption. Thus, it is now impossible to use classical tools anymore, like DPI (deep pakets inspection), in order to detect malicious behaviour on the Internet. The main target of this thesis is to find new ways to monitor malicious behaviours despite the use of encryption (HTTPS). This new solution should, nevertheless, follow tree guidelines: passivity, transparency and privacy preservation. According to the works in the state of the art for encrypted traffic monitoring, they mainly focus about protocols or services detection but not about the detections of the users' behavior inside a service. The first objective is to construct a monitoring solution in order to detect some behaviour inside a web service protected by HTTPS used with HTTP/1.1. We develop an example which detects requests related to non-legitimate keywords on Images search engine by only monitoring the encrypted traffic. The solution reconstructs the size of the encrypted HTTP objects and builds a footprint of the related traffic by using the Kernel Density estimation method (KDE). The evaluation of this traffic classification when monitoring 10 000 keywords achieved an accuracy of more than 99% considering an open world scenario. Despite, this solution is very effective when monitoring HTTP/1.1 traffic, it shows some limitation when dealing with HTTP/2 traffic because of its impact on the traffic. Thus, the second goal is to adapt our knowledge for purposes of detecting keywords when HTTPS is used with HTTP/2. This new method is structured around some features collected on the encrypted traffic and use supervised machine learning (random forest) to classify them. The solution called H2Classifier is evaluated over four very used services (Amazon, Google, Google Images and Google Maps) and achieve a TPR between 61 and 98% depending of the service when monitoring 2000 keywords (per service) considering open world scenario. Finally, H2Classifier evaluated over the time, against new services and with new configurations too.
Complete list of metadata

https://hal.univ-lorraine.fr/tel-03184002
Contributor : Thèses Ul <>
Submitted on : Monday, March 29, 2021 - 10:37:17 AM
Last modification on : Tuesday, March 30, 2021 - 3:43:55 AM

File

DDOC_T_2020_0255_BRISSAUD.pdf
Files produced by the author(s)

Identifiers

  • HAL Id : tel-03184002, version 1

Citation

Pierre-Olivier Brissaud. Analyse de trafic HTTPS pour la supervision d'activités utilisateurs. Réseaux et télécommunications [cs.NI]. Université de Lorraine, 2020. Français. ⟨NNT : 2020LORR0255⟩. ⟨tel-03184002⟩

Share

Metrics

Record views

88

Files downloads

39