Detection of Malicious Network Traffic Behavior Using JA3 Fingerprints
Loading...
Date
2022
Authors
ORCID
Advisor
Referee
Mark
Journal Title
Journal ISSN
Volume Title
Publisher
Vysoké učení technické v Brně, Fakulta elektrotechniky a komunikačních technologií
Altmetrics
Abstract
This paper presents a novel approach for classifying spoof network traffic based on JA3 fingerprint clustering. In particular, it concerns the detection of so-called zero-day malware. The proposed method does not work with known JA3 hashes. However, it compares the JA3 fingerprint of captured traffic with JA3 fingerprints of traffic with predefined criteria, such as the use of current cipher suites or protocol, for classification.
Description
Citation
Proceedings II of the 28st Conference STUDENT EEICT 2022: Selected papers. s. 194-197. ISBN 978-80-214-6030-0
https://conf.feec.vutbr.cz/eeict/index/pages/view/ke_stazeni
https://conf.feec.vutbr.cz/eeict/index/pages/view/ke_stazeni
Document type
Peer-reviewed
Document version
Published version
Date of access to the full text
Language of document
en
Study field
Comittee
Date of acceptance
Defence
Result of defence
Document licence
© Vysoké učení technické v Brně, Fakulta elektrotechniky a komunikačních technologií