Ocurring SNIs for Servicve Indetification
Yuto Soma, Akihiro Nakao, Masato Oguchi, Shu Yamamoto, Saneyasu Yamaguchi, Aki Kobayashi · 2020
Many services such as vide sharing and web search are provided in the current Internet. We expect that identifying the service from IP flows is useful for many things. However, many current IP flows are encrypted by TLS (Transport Layer Security), and analyzing encrypted payloads of packets in these flows is almost impossible. For this issue, a method for identifying the service by analyzing the SNI (Server Name Indication), which is an extension field of the TLS and is not encrypted with TLS 1.2 or less, for TLS 1.2 was provided. This method studies the occurring SNIs in access to each service before identification and estimates the service based on Bayesian inference. This method explicitly assumes that the occurring SNIs includes the feature of each service. Also, this implicitly does that the sets of occurring SNIs are stable. In this work, we investigate the occurring SNIs at accessing each service and point out that the occurring SNIs are not stable in the cases of several services. We show that the number of occurring SNIs keeps increasing in these cases.