Positional-Unigram Byte Models for Generalized TLS Fingerprinting

arXiv:2405.07848v1 Announce Type: new
Abstract: We use positional-unigram byte models along with maximum likelihood for generalized TLS fingerprinting and empirically show that it is robust to cipher stunting. Our approach creates a set of positional-unigram byte models from client hello messages. Each positional-unigram byte model is a statistical model of TLS client hello traffic created by a client application or process. To fingerprint a TLS connection, we use its client hello, and compute the likelihood as a function of a …

arxiv cipher client cs.cr fingerprinting hello messages tls tls fingerprinting