论文标题
DeepTLS：加密流量的全面和高性能提取
DeepTLS: comprehensive and high-performance feature extraction for encrypted traffic
论文作者
论文摘要
功能提取对于使用机器学习技术TLS流量分析至关重要，这也非常困难且耗时，需要巨大的工程工作。我们设计和实施了DEEPTL，该系统可从元，统计，SPLT，字节分布，TLS标头和证书中提取PCAP的全部功能。后端用C ++编写以实现高性能，可以在几分钟内分析GB大小的PCAP。 DeepTL对两个最先进的工具Joy和Zeek进行了彻底评估，其中四个著名的恶意交通数据集由160个PCAPS组成。评估结果表明，DEEPTL具有一半分析时间分析大型PCAP的优势，并确定了更多的证书，与JOY相比，可接受的性能损失。 DEEPTL可以通过将功能提取时间从数小时甚至几天减少到几分钟来大大加速机器学习管道。该系统在https://deeptls.com上在线，可以在其中查看和验证测试工件。此外，还发布了两个开源工具PysharkFeat和TLSFeatmark。
Feature extraction is critical for TLS traffic analysis using machine learning techniques, which it is also very difficult and time-consuming requiring huge engineering efforts. We designed and implemented DeepTLS, a system which extracts full spectrum of features from pcaps across meta, statistical, SPLT, byte distribution, TLS header and certificates. The backend is written in C++ to achieve high performance, which can analyze a GB-size pcap in a few minutes. DeepTLS was thoroughly evaluated against two state-of-the-art tools Joy and Zeek with four well-known malicious traffic datasets consisted of 160 pcaps. Evaluation results show DeepTLS has advantage of analyzing large pcaps with half analysis time, and identified more certificates with acceptable performance loss compared with Joy. DeepTLS can significantly accelerate machine learning pipeline by reducing feature extraction time from hours even days to minutes. The system is online at https://deeptls.com, where test artifacts can be viewed and validated. In addition, two open source tools Pysharkfeat and Tlsfeatmark are also released.
