A Survey of Methods for Encrypted Traffic Classification andAnalysis <s> The Unencrypted Initialization Phase <s> The SSL and TLS infrastructure used in important protocols like HTTPs and IMAPs is built on an X.509 public-key infrastructure (PKI). X.509 certificates are thus used to authenticate services like online banking, shopping, e-mail, etc. However, it always has been felt that the certification processes of this PKI may lack in stringency, resulting in a deployment where many certificates do not meet the requirements of a secure PKI. This paper presents a comprehensive analysis of X.509 certificates in the wild. To shed more light on the state of the deployed and actually used X.509 PKI, we obtained and evaluated data from many different sources. We conducted HTTPs scans of a large number of popular HTTPs servers over a 1.5-year time span, including scans from nine locations distributed over the globe. To compare certification properties of highly ranked hosts with the global picture, we included a third-party scan of the entire IPv4 space in our analyses. Furthermore, we monitored live SSL/TLS traffic on a 10Gbps uplink of a large research network. This allows us to compare the properties of the deployed PKI with the part of the PKI that is being actively accessed by users. Our analysis reveals that the quality of certification lacks in stringency, due to a number of reasons among which incorrect certification chains or invalid certificate subjects give the most cause for concern. Similar concerns can be raised for the properties of certification chains and many self-signed certificates used in the deployed X.509 PKI. Our findings confirm what has long been believed -- namely that the X.509 PKI we often use in our everyday's lives is in a sorry state. <s> BIB001 </s> A Survey of Methods for Encrypted Traffic Classification andAnalysis <s> The Unencrypted Initialization Phase <s> We report the results of a large-scale measurement study of the HTTPS certificate ecosystem---the public-key infrastructure that underlies nearly all secure web communications. Using data collected by performing 110 Internet-wide scans over 14 months, we gain detailed and temporally fine-grained visibility into this otherwise opaque area of security-critical infrastructure. We investigate the trust relationships among root authorities, intermediate authorities, and the leaf certificates used by web servers, ultimately identifying and classifying more than 1,800 entities that are able to issue certificates vouching for the identity of any website. We uncover practices that may put the security of the ecosystem at risk, and we identify frequent configuration problems that lead to user-facing errors and potential vulnerabilities. We conclude with lessons and recommendations to ensure the long-term health and security of the certificate ecosystem. <s> BIB002
Almost all network protocols ensure secure data transfer by means of encryption containing an unencrypted initialization phase, as depicted in Figure 1 . Because the data exchanged at this stage are not encrypted, they can be easily extracted and used for monitoring network traffic. Generally, two types of information common to most protocols can be extracted during this phase. The first type covers the connection itself, and its properties exchanged in the initial handshake. The second type covers communicating peers' identifiers which are exchanged in the authentication phase. During the initial handshake, parameters of a connection are negotiated, such cipher suites and which protocol version is used. This dynamic setting of the connection properties enables backward compatibility for different versions of software or is used to set a different level of security based on established security policies. Some examples of this are data authentication and compression in addition to encryption itself. The list of possible identifications, with references to algorithm specification for IPsec, TLS, SSH and other protocols, can be found in IANA Protocol Registries  . All of this information can be used for proper connection characterization and correct parsing of other packets in the rest of the connection. One interesting use of the information from the initial handshake is presented by client fingerprinting based on the provided cipher-suites. A large amount of cipher-suites types exists, which usually are not all implemented by the client's applications. Therefore, each application specifies the supported cipher-suites and also prefers using them during the initial handshake. This makes it possible to passively distinguish specific operating systems, web browsers and other applications, together with their versions, based only on the cipher-suites which they use. An example of such client fingerprinting, based on the SSL/TLS initial handshake, is presented by applications from SSL Labs  and p0f module  . The authentication phase represents the second source of information which can be easily extracted from secured network traffic. Unique identifiers of one or both communicating peers, optionally supplemented by additional data about them, are exchanged during this phase. For example, in the authentication phase of the SSH protocol, the server sends its public key to the user. The user must validate the key and verify that the server knows the appropriate private key  . Since this information is almost unique for each SSH server, it is possible to detect server changes or man-in-the-middle attacks on them by passive network traffic monitoring. A very good example of extracting information from communication peers is demonstrated by monitoring the authentication phase of the SSL/TLS protocol. The server, and optionally even the client, sends their X.509 certificates  to each other to verify their identities in this phase. This certificate contains a public key signed by the certification authority which is supplemented with information about the peer and issuer. More detailed content of such certificates is shown in Figure 5 . Monitoring passive certificates enables not only the identification of communicating peers but also the ability to check whether these certificates are valid and contains proper security algorithms to fulfil local security policies. SSL/TLS certificate properties were studied by Holz et al. BIB001 who revealed a great number of invalid certificates and some which were shared between a large number of hosts. Holz et al's work was followed by Durumeric et al. BIB002 who mainly focused on assessing certification authorities. Certificate monitoring can also be used to detect malicious software trying to hide its activities by connecting with their command and controls centres using the SSL/TLS protocol [65] .