František Střasák & Jan Fajfer - Increasing Efficiency of Encr. Traffic Analysis of People at Risk

### Overview Researchers Frank Střasák and Jan Fajfer from the Civil Sphere Project at the Czech Technical University in Prague describe their work supporting people at risk—including journalists, human rights defenders, and lawyers—who lack commercial security teams. The initiative operates the "Emergency VPN" project, a free remote service where at-risk users route traffic to an OpenVPN server for three days of packet capture to uncover ongoing infections, malware traffic, or vulnerabilities. Because manually inspecting packets can take eight hours or more per three-day capture, the team explores machine learning and deep learning approaches to accelerate the triage of encrypted network connections.

### Key Topics - **Emergency VPN Service**: Providing manual network traffic assessments for mobile devices owned by high-risk civil society members using OpenVPN profiles. - **Encrypted Traffic Analysis Bottlenecks**: High manual effort required to investigate TLS/HTTPS connections and identify stealthy patterns such as periodic Command and Control (C2) or data exfiltration. - **Impact of TLS 1.3**: The architectural changes in TLS 1.3, specifically handshake certificate encryption, which broke previous feature extraction methods relying on certificate metadata. - **Deep Learning for Encrypted Flows**: Transitioning to raw TCP-layer network behavioral features processed by a 1D convolutional neural network inspired by ResNet. - **Human-in-the-Loop Filtering**: Utilizing ML models not as autonomous endpoint blocks, but as filtering mechanisms to strip away 90%+ benign traffic so human analysts can inspect the remaining anomalies.

### Technical Details Initially, the researchers generated flows using Zeek (formerly Bro) from network captures, aggregating flows sharing identical source IP, destination IP, destination port, and protocol into "SSL aggregations." They extracted 40 features primarily focused on plaintext TLS certificates (such as validity periods, SAN domains, and certificate chains), achieving roughly 95% accuracy using models like Random Forests and XGBoost.

However, TLS 1.3 introduced handshake certificate encryption, rendering certificate-based features unavailable. To adapt, the team created a new feature representation independent of certificate data, focusing entirely on lower-level TCP/TLS behavioral patterns (bytes, packet counts, inter-arrival times/periodicity). They formulated sequences across flows within an SSL aggregation, zero-padding the sequence length to 250 across six feature channels. This input was fed into a convolutional neural network inspired by ResNet image classification architectures.

Trained on balanced datasets (80,000 malware samples from CTU-14/MCFP and 80,000 normal traffic samples), the CNN model achieved 94% accuracy, a 7% false positive rate, and a 3% false negative rate. In a simulated Android mobile infection test, the model flagged benign traffic (such as Inbox by Google) as false positives, but successfully captured the C2 communication to an IP address in China. Over 40 real captures, the model filtered out approximately 91% of traffic as benign.

### Takeaways While modern encrypted traffic analysis via TCP metadata cannot act as a reliable standalone detector due to false positives, it serves as a powerful pre-filter for human analysts. By eliminating more than 90% of benign traffic, analysts can reduce review times drastically. Future improvements include training specialized models on native mobile traffic rather than desktop Windows datasets and segmenting models across operating systems and protocols.