Service Identification Based on SNI Analysis
Hiroaki Yamauchi, Akihiro Nakao, Masato Oguchi, Shu Yamamoto, Saneyasu Yamaguchi · 2020
It is expected that heavy congestion occurs at a time of a severe disaster. In such a situation, traffic priority control in network elements for preferentially transferring information for rescue is important. For achieving this, service identification from IP flows in network elements is required. A method based on deep packet inspection (DPI) of multiple TLS sessions has been proposed for identifying services from IP flows. However, its analysis is extremely CPU time-consuming. In this paper, we propose a new service identification method based on the analysis of Server Name Indication (SNI). SNI is a not-encrypted field in the ClientHello message, which is transferred in the TLS session establishment. We then evaluate the proposed method and show that the proposed methods significantly reduce time to identify without a large decline in the accuracy of identification.