Encrypted Network Traffic Analysis Method via Secure Socket Layer Handshake Control

Abstract

As the amount of encrypted network traffic on enterprise networks increases steadily, the problem of malicious acts encrypted to bypass security devices has emerged. Previous studies analyzed the encrypted network traffic by changing the network traffic or communication flow between the encrypted communications to analyze such encrypted malicious behavior. However, there are limitations to the existing methods because they require additional prior-data or additional network configurations in order to analyze the encrypted network traffic. In this paper, we propose a system to decrypt secure socket layer network traffic to analyze the encrypted network traffic in the enterprise network environment. The proposed system can be used to analyze encrypted network traffic in order to detect malicious activity and corporate information leaks.