{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,5,15]],"date-time":"2025-05-15T14:53:10Z","timestamp":1747320790744,"version":"3.28.0"},"reference-count":26,"publisher":"IEEE","license":[{"start":{"date-parts":[[2022,10,19]],"date-time":"2022-10-19T00:00:00Z","timestamp":1666137600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2022,10,19]],"date-time":"2022-10-19T00:00:00Z","timestamp":1666137600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2022,10,19]]},"DOI":"10.1109\/ictc55196.2022.9952872","type":"proceedings-article","created":{"date-parts":[[2022,11,25]],"date-time":"2022-11-25T22:41:09Z","timestamp":1669416069000},"page":"1273-1278","source":"Crossref","is-referenced-by-count":4,"title":["Revisiting TLS-Encrypted Traffic Fingerprinting Methods for Malware Family Classification"],"prefix":"10.1109","author":[{"given":"Hyundo","family":"Kim","sequence":"first","affiliation":[{"name":"Korea University Sejong Campus,Dept. of AI Cyber Security,Sejong,Republic of Korea"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Minsu","family":"Kim","sequence":"additional","affiliation":[{"name":"Korea University Sejong Campus,Dept. of AI Cyber Security,Sejong,Republic of Korea"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Joonseo","family":"Ha","sequence":"additional","affiliation":[{"name":"Korea University Sejong Campus,Dept. of AI Cyber Security,Sejong,Republic of Korea"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Heejun","family":"Roh","sequence":"additional","affiliation":[{"name":"Graduate School Korea University,Dept. of Cyber Security,Sejong,Republic of Korea"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"journal-title":"Open Sourcing JA3 SSL\/TLS Client Fingerprinting for Malware Detection","year":"2017","author":"althouse","key":"ref10"},{"key":"ref11","article-title":"Accurate TLS Fingerprinting using Destination Context and Knowledge Bases","author":"anderson","year":"0","journal-title":"ArXiv 2020"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.3390\/app12010155"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1145\/3355369.3355601"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1145\/2996758.2996768"},{"key":"ref15","article-title":"TLS Encrypted Client Hello","author":"rescorla","year":"0","journal-title":"IETF Datatracker"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1002\/nem.1901"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1145\/1368436.1368445"},{"key":"ref18","article-title":"Indicators of Compromise (IoCs) and Their Role in Attack Defence, draft-paine-smart-indicators-of-compromise-03","author":"paine","year":"2021","journal-title":"Internet Engineering Task Force"},{"journal-title":"TLS Fingerprinting with JA3 and JA3S","year":"2019","author":"althouse","key":"ref19"},{"journal-title":"Let's encrypt stats","year":"2022","key":"ref4"},{"journal-title":"HTTPS encryption on the web","year":"2022","key":"ref3"},{"journal-title":"Cyren Security Blog","year":"2017","key":"ref6"},{"journal-title":"Hiding in Plain Sight Malware's Use of TLS and En-cryption","year":"2016","key":"ref5"},{"journal-title":"Internet Security Report Q2 2021","year":"2021","key":"ref8"},{"journal-title":"Internet Security Report Q1 2020","year":"2020","key":"ref7"},{"key":"ref2","article-title":"Measuring HTTPS Adoption on the Web","author":"felt","year":"2017","journal-title":"Proceedings of USENIX Security Symposium"},{"key":"ref9","article-title":"Markov Chain Fingerprinting to Clas-sify Encrypted Traffic","author":"korczynski","year":"2014","journal-title":"Proceedings of the 33rd IEEE International Conference on Computer Communications (INFOCOM)"},{"journal-title":"Browser Market share","year":"2020","key":"ref1"},{"key":"ref20","first-page":"1830","article-title":"Classification of Encrypted Traffic with Second-Order Markov Chains and Application At-tribute Bigrams","volume":"2017","author":"shen","year":"0","journal-title":"IEEE Trans Inf Forensics Secur"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.3390\/electronics 10243180"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM.2019.8737507"},{"key":"ref24","article-title":"Applying Generate Random Extensions And Sustain Extensibility (GREASE) to TLS Extensibility","author":"benjamin","year":"2021","journal-title":"RFC 8701 Internet Engineering Task Force"},{"key":"ref23","article-title":"Network Protocol Fingerprinting (NPF): A Flexible System for Identifying Protocol Implementations","author":"mcgrew","year":"2022","journal-title":"Pre-publication draft"},{"journal-title":"Malware Traffic Analysis","year":"0","author":"duncan","key":"ref26"},{"key":"ref25","article-title":"JA3cury-A New Approach to TLS Fingerprinting by Merging Fingerprinting Methods","author":"hejcman","year":"2021","journal-title":"Excel FIT"}],"event":{"name":"2022 13th International Conference on Information and Communication Technology Convergence (ICTC)","start":{"date-parts":[[2022,10,19]]},"location":"Jeju Island, Korea, Republic of","end":{"date-parts":[[2022,10,21]]}},"container-title":["2022 13th International Conference on Information and Communication Technology Convergence (ICTC)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/9952188\/9952355\/09952872.pdf?arnumber=9952872","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,12,19]],"date-time":"2022-12-19T20:00:52Z","timestamp":1671480052000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9952872\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,10,19]]},"references-count":26,"URL":"https:\/\/doi.org\/10.1109\/ictc55196.2022.9952872","relation":{},"subject":[],"published":{"date-parts":[[2022,10,19]]}}}