Indicators of Malicious SSL Connections

Riccardo Bortolameotti; Andreas Peter; Maarten Hinderik Everts; D. Bolzoni

doi:10.1007/978-3-319-25645-0_11

Indicators of Malicious SSL Connections

Riccardo Bortolameotti, Andreas Peter, Maarten Hinderik Everts, D. Bolzoni

Databases (Former)

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Academic › peer-review

3 Citations (Scopus)

Abstract

Internet applications use SSL to provide data confidential- ity to communicating entities. The use of encryption in SSL makes it impossible to distinguish between benign and malicious connections as the content cannot be inspected. Therefore, we propose and evaluate a set of indicators for malicious SSL connections, which is based on the unencrypted part of SSL (i.e., the SSL handshake protocol). We provide strong evidence for the strength of our indicators to identify malicious connections by cross-checking on blacklists from professional services. Besides the confirmation of prior research results through our indicators, we also found indications for a potential (not yet blacklisted) botnet on SSL. We consider the analysis of such SSL threats as highly relevant and hope that our findings stimulate the research community to further study this direction.

Original language	Undefined
Title of host publication	9th International Conference on Network and System Security, NSS 2015
Place of Publication	New York
Publisher	Springer
Pages	162-175
Number of pages	14
ISBN (Print)	978-3-319-25645-0
DOIs	https://doi.org/10.1007/978-3-319-25645-0_11
Publication status	Published - Nov 2015
Event	9th International Conference on Network and System Security, NSS 2015 - New York, United States Duration: 3 Nov 2015 → 5 Nov 2015 Conference number: 9

Publication series

Name	Lecture Notes in Computer Science
Publisher	Springer Verlag
Volume	9408

Conference

Conference	9th International Conference on Network and System Security, NSS 2015
Abbreviated title	NSS
Country/Territory	United States
City	New York
Period	3/11/15 → 5/11/15

Keywords

SCS-Cybersecurity
IR-98163
METIS-315016
EWI-26432

Access to Document

10.1007/978-3-319-25645-0_11

http://eprints.eemcs.utwente.nl/secure2/26432/01/NSS2015.pdf

Cite this

@inproceedings{03ce9bf6448545a8aa2b135e51e2f41d,

title = "Indicators of Malicious SSL Connections",

abstract = "Internet applications use SSL to provide data confidential- ity to communicating entities. The use of encryption in SSL makes it impossible to distinguish between benign and malicious connections as the content cannot be inspected. Therefore, we propose and evaluate a set of indicators for malicious SSL connections, which is based on the unencrypted part of SSL (i.e., the SSL handshake protocol). We provide strong evidence for the strength of our indicators to identify malicious connections by cross-checking on blacklists from professional services. Besides the confirmation of prior research results through our indicators, we also found indications for a potential (not yet blacklisted) botnet on SSL. We consider the analysis of such SSL threats as highly relevant and hope that our findings stimulate the research community to further study this direction.",

keywords = "SCS-Cybersecurity, IR-98163, METIS-315016, EWI-26432",

author = "Riccardo Bortolameotti and Andreas Peter and Everts, {Maarten Hinderik} and D. Bolzoni",

year = "2015",

month = nov,

doi = "10.1007/978-3-319-25645-0_11",

language = "Undefined",

isbn = "978-3-319-25645-0",

series = "Lecture Notes in Computer Science",

publisher = "Springer",

pages = "162--175",

booktitle = "9th International Conference on Network and System Security, NSS 2015",

address = "Germany",

note = "9th International Conference on Network and System Security, NSS 2015 ; Conference date: 03-11-2015 Through 05-11-2015",

}

Bortolameotti, R, Peter, A , Everts, MH & Bolzoni, D 2015, Indicators of Malicious SSL Connections. in 9th International Conference on Network and System Security, NSS 2015. Lecture Notes in Computer Science, vol. 9408, Springer, New York, pp. 162-175, 9th International Conference on Network and System Security, NSS 2015, New York, New York, United States, 3/11/15. https://doi.org/10.1007/978-3-319-25645-0_11

Indicators of Malicious SSL Connections. / Bortolameotti, Riccardo; Peter, Andreas ; Everts, Maarten Hinderik et al.
9th International Conference on Network and System Security, NSS 2015. New York: Springer, 2015. p. 162-175 (Lecture Notes in Computer Science; Vol. 9408).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Academic › peer-review

TY - GEN

T1 - Indicators of Malicious SSL Connections

AU - Bortolameotti, Riccardo

AU - Peter, Andreas

AU - Everts, Maarten Hinderik

AU - Bolzoni, D.

N1 - Conference code: 9

PY - 2015/11

Y1 - 2015/11

N2 - Internet applications use SSL to provide data confidential- ity to communicating entities. The use of encryption in SSL makes it impossible to distinguish between benign and malicious connections as the content cannot be inspected. Therefore, we propose and evaluate a set of indicators for malicious SSL connections, which is based on the unencrypted part of SSL (i.e., the SSL handshake protocol). We provide strong evidence for the strength of our indicators to identify malicious connections by cross-checking on blacklists from professional services. Besides the confirmation of prior research results through our indicators, we also found indications for a potential (not yet blacklisted) botnet on SSL. We consider the analysis of such SSL threats as highly relevant and hope that our findings stimulate the research community to further study this direction.

AB - Internet applications use SSL to provide data confidential- ity to communicating entities. The use of encryption in SSL makes it impossible to distinguish between benign and malicious connections as the content cannot be inspected. Therefore, we propose and evaluate a set of indicators for malicious SSL connections, which is based on the unencrypted part of SSL (i.e., the SSL handshake protocol). We provide strong evidence for the strength of our indicators to identify malicious connections by cross-checking on blacklists from professional services. Besides the confirmation of prior research results through our indicators, we also found indications for a potential (not yet blacklisted) botnet on SSL. We consider the analysis of such SSL threats as highly relevant and hope that our findings stimulate the research community to further study this direction.

KW - SCS-Cybersecurity

KW - IR-98163

KW - METIS-315016

KW - EWI-26432

U2 - 10.1007/978-3-319-25645-0_11

DO - 10.1007/978-3-319-25645-0_11

M3 - Conference contribution

SN - 978-3-319-25645-0

T3 - Lecture Notes in Computer Science

SP - 162

EP - 175

BT - 9th International Conference on Network and System Security, NSS 2015

PB - Springer

CY - New York

T2 - 9th International Conference on Network and System Security, NSS 2015

Y2 - 3 November 2015 through 5 November 2015

ER -