Real-Time Classification of TLS ClientHello Packets Using Graph SAGE
Alwyn D Souza, Asmita Poojari · 2025
With the growing emphasis on security of information and networks in this decade, secure protocols are being widely adopted and implemented at scale. TLS (Transport Layer Security), developed as an enhancement of SSL, is a session-layer protocol which is used to establish sessions between a client and a server. However, the encrypted nature of the protocol makes it difficult to analyze the packets. Some of the recent studies have examined the encrypted traffic by decrypting it beforehand, but this approach compromises privacy and adds significant computational cost. This study aims at leveraging the morphological similarities of TLS ClientHello packets to accurately classify unseen packets without the need for decryption. Graph data is constructed, comprising nodes and edges. The node features include MessageLen, TLS-version, number of cipher suites, number of extensions whereas the edges are constructed between the nodes based on the cosine similarity of the node features. GraphSAGE is used to generate embeddings for the nodes of the graph, its inductive nature makes it feasible to generate useful embeddings for previously unseen nodes. The model achieved a classification accuracy of 99 % and AUC close to 1, with minimal training time, while preserving user privacy, significantly reducing time and computational cost associated with decrypting the TLS traffic.