Entropy estimation for real-time encrypted traffic identification (Short Paper)

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

Volumn 6613 LNCS, Issue , 2011, Pages 164-171

  Dorfinger, Peter ^a   Panholzer, Georg ^a   John, Wolfgang ^b  

^a SALZBURG RESEARCH   (Austria)

^b CHALMERS UNIVERSITY OF TECHNOLOGY   (Sweden)

Author keywords

entropy estimation; real time detection; traffic filtering

Indexed keywords

CLASSIFICATION APPROACH; ENCRYPTED TRAFFIC; ENTROPY ESTIMATION; GROUND TRUTH; NETWORK TRAFFIC; PACKET PAYLOADS; REAL NETWORKS; REAL-TIME DETECTION; TRAFFIC FILTERING;

CRYPTOGRAPHY; DETECTORS; ENTROPY; ESTIMATION; HTTP; INTERNET PROTOCOLS; SIGNAL DETECTION;

SECURITY OF DATA;

EID: 79955088769     PISSN: 03029743     EISSN: 16113349     Source Type: Book Series    
DOI: 10.1007/978-3-642-20305-3_14     Document Type: Conference Paper

References (11)

1. Lyda, R., Hamrock, J.: Using entropy analysis to find encrypted and packed malware. IEEE Security & Privacy 5(2), 40-45 (2007) (Pubitemid 46527387)
2. Olivain, J., Goubault-Larrecq, J.: Detecting subverted cryptographic protocols by entropy checking. Research Report LSV-06-13, Laboratoire Sṕecification et V́erification, ENS Cachan (2006)
3. Pescape, A.: Entropy-based reduction of traffic data. IEEE Communications Letters 11(2), 191-193 (2007) (Pubitemid 46502239)
4. Dorfinger, P., Panholzer, G., Trammell, B., Pepe, T.: Entropy-based traffic filtering to support real-time Skype detection. In: IWCMC, Caen, France, pp. 747-751 (2010)
5. Shannon, C.E.: A mathematical theory of communication. Bell System Technical Journal 27, 379-423, 625-656 (1948)
6. Schürmann, T.: Bias analysis in entropy estimation. Journal of Physics A: Mathematical and General 37(27), L295-L301 (2004) (Pubitemid 38904275)
7. Paninski, L.: A coincidence-based test for uniformity given very sparsely sampled discrete data. IEEE Transactions on Information Theory 54(10), 4750-4755 (2008)
8. Paninski, L.: Estimation of entropy and mutual information. Neural Computation 15(6), 1191-1253 (2003) (Pubitemid 37049793)
9. Dorfinger, P.: Real-Time Detection of Encrypted Traffic based on Entropy Estimation. Master's thesis, Salzburg University of Applied Sciences, Austria (2010)
10. Hjelmvik, E., John, W.: Breaking and improving protocol obfuscation. Tech. Rep. 2010-05, Computer Science and Engineering, Chalmers University of Technology (2010), http://www.iis.se/docs/hjelmvik-breaking.pdf (28.01.2011)
11. Adami, D., Callegari, C., Giordano, S., Pagano, M., Pepe, T.: A Real-Time Algorithm for Skype Traffic Detection and Classification. In: Balandin, S., Moltchanov, D., Koucheryavy, Y. (eds.) ruSMART 2009. LNCS, vol. 5764, pp. 168-179. Springer, Heidelberg (2009)