Title :
Statistical Pattern Recognition Based Content Analysis on Encrypted Network: Traffic for the TeamViewer Application
Author :
Altschaffel, Robert ; Clausing, Robert ; Kraetzer, Christian ; Hoppe, Tobias ; Kiltz, Stefan ; Dittmann, Jana
Author_Institution :
Adv. Multimedia & Security Lab., Otto-von-Guerricke-Univ., Magdeburg, Germany
Abstract :
In the course of a forensic investigation it might be required to distinguish between different network activities. While various means to analyse network traffic exist, encrypted traffic often makes such an analysis problematic. The focus of this paper is to introduce a method based on statistical pattern recognition on network recordings of encrypted sessions to distinguish between different actions within these sessions. For demonstration purposes the popular remote support and online-meeting application TeamViewer is selected to introduce and discuss an approach to distinguish between file transfers, voice conferences, video conferences, text chat and normal remote sessions within TeamViewer sessions.
Keywords :
computer network security; cryptography; data analysis; digital forensics; pattern recognition; statistical analysis; telecommunication traffic; TeamViewer application; TeamViewer session; encrypted network traffic; file transfer; forensic investigation; network activity; network recording; network traffic analysis; online-meeting application; remote session; remote support application; statistical pattern recognition based content analysis; text chat; video conference; voice conference; Cryptography; Feature extraction; Inspection; Pattern recognition; Payloads; Standards; Training; classification; encrypted traffic; statistical analysis; traffic analysis;
Conference_Titel :
IT Security Incident Management and IT Forensics (IMF), 2013 Seventh International Conference on
Conference_Location :
Nuremberg
Print_ISBN :
978-1-4673-6307-5
DOI :
10.1109/IMF.2013.19
