Analysis of TLS Encrypted Communication Behavior Based on Bipartite Graph and Traffic Information Embedding

Currently, encrypted traffic using the TLS protocol is widely used, and there are a lot of malicious and unknown behaviors. It is an important goal in the research field to detect the traffic behavior of TLS and maintain network security and stability. This article is based on TLS encrypted traffic, taking the multi-session communication traffic between the client and the server as the object, and carrying out traffic analysis on the generated bipartite graph. Different from the existing works, this paper focuses on the multiple attributes of TLS traffic and transforms it into a bipartite graph with rich attributes, and breaks the bottleneck of single session traffic detection, avoiding simple graph mining mode analysis. The results of anomaly detection and application classification experiments based on real data sets show that similar client application objects and application behaviors show similar traffic characteristics. Finally, we discussed the importance of using the behavioral similarity of client response objects to identify and detect abnormal traffic in network applications.