{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,28]],"date-time":"2026-09-28T11:40:41Z","timestamp":1790595641510,"version":"4.1.0"},"publisher-location":"New York, NY, USA","reference-count":62,"publisher":"ACM","license":[{"start":{"date-parts":[[2024,5,13]],"date-time":"2024-05-13T00:00:00Z","timestamp":1715558400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100006374","name":"European Commission","doi-asserted-by":"publisher","award":["101070416"],"award-info":[{"award-number":["101070416"]}],"id":[{"id":"10.13039\/501100006374","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2024,5,13]]},"DOI":"10.1145\/3589334.3645719","type":"proceedings-article","created":{"date-parts":[[2024,5,8]],"date-time":"2024-05-08T07:08:13Z","timestamp":1715152093000},"page":"1933-1944","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":7,"title":["Fingerprinting the Shadows: Unmasking Malicious Servers with Machine Learning-Powered TLS Analysis"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0008-6672-2133","authenticated-orcid":false,"given":"Andreas","family":"Theofanous","sequence":"first","affiliation":[{"name":"Foundation for Research and Technology - Hellas, Heraklion, Greece"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0205-964X","authenticated-orcid":false,"given":"Eva","family":"Papadogiannaki","sequence":"additional","affiliation":[{"name":"Technical University of Crete, Chania, Greece"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5072-5569","authenticated-orcid":false,"given":"Alexander","family":"Shevtsov","sequence":"additional","affiliation":[{"name":"Technical University of Crete, Chania, Greece"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9340-2241","authenticated-orcid":false,"given":"Sotiris","family":"Ioannidis","sequence":"additional","affiliation":[{"name":"Technical University of Crete, Chania, Greece"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2024,5,13]]},"reference":[{"key":"e_1_3_2_2_1_1","first-page":"0f","volume-title":"SSL Fingerprinting for","unstructured":"2012. SSL Fingerprinting for p0f. https:\/\/idea.popcount.org\/2012-06--17-sslfingerprinting-for-p0f\/. Accessed: 2023-08--11."},{"key":"e_1_3_2_2_2_1","unstructured":"2016. FingerprinTLS. https:\/\/github.com\/LeeBrotherston\/tls-fingerprinting. Accessed: 2023-08--11."},{"key":"e_1_3_2_2_3_1","unstructured":"2019. https:\/\/tranco-list.eu\/. Accessed: 2023-08--11."},{"key":"e_1_3_2_2_4_1","unstructured":"2019. HTTPS encryption on the web -- Google Transparency Report. https: \/\/transparencyreport.google.com\/https\/overview?hl=en. Accessed on 2023-08-11."},{"key":"e_1_3_2_2_5_1","unstructured":"2020. JARM: A Solid Fingerprinting Tool for Detecting Malicious Servers. https: \/\/securitytrails.com\/blog\/jarm-fingerprinting-tool. Accessed on 2023-08--11."},{"key":"e_1_3_2_2_6_1","unstructured":"2020. JARM: An active Transport Layer Security (TLS) server fingerprinting tool. https:\/\/github.com\/salesforce\/jarm. Accessed: 2023-08--11."},{"key":"e_1_3_2_2_7_1","unstructured":"2020. Suricata Open Source IDS \/ IPS \/ NSM engine. https:\/\/www.suricata-ids.org\/. Accessed: 2023-08--11."},{"key":"e_1_3_2_2_8_1","unstructured":"2021. The 2021 TLS Telemetry Report. https:\/\/www.f5.com\/labs\/articles\/threatintelligence\/ the-2021-tls-telemetry-report. Accessed: 2023-08--11."},{"key":"e_1_3_2_2_9_1","unstructured":"2021. The Feodo Tracker Browse Botnet C&Cs. https:\/\/feodotracker.abuse.ch\/ browse\/. Accessed: 2023-08--11."},{"key":"e_1_3_2_2_10_1","unstructured":"2021. The SSL Blacklist (SSLBL) . https:\/\/sslbl.abuse.ch\/blacklist\/sslipblacklist.txt. Accessed: 2023-08--11."},{"key":"e_1_3_2_2_11_1","volume-title":"WatchGuard Threat Lab Reports 91.5Arrived over Encrypted Connections in Q2","year":"2021","unstructured":"2021. WatchGuard Threat Lab Reports 91.5Arrived over Encrypted Connections in Q2 2021. https:\/\/www.watchguard.com\/wgrd-news\/press-releases\/ watchguard-threat-lab-reports-915-malware-arrived-over-encrypted. Accessed: 2023-08--11."},{"key":"e_1_3_2_2_12_1","unstructured":"2022. Spoiler: New ThreatLabz Report Reveals Over 85Attacks Are Encrypted. https:\/\/www.zscaler.com\/blogs\/security-research\/2022-encryptedattacks-report. Accessed: 2023-08--11."},{"key":"e_1_3_2_2_13_1","unstructured":"2023. https:\/\/lists.blocklist.de\/lists\/all.txt. Accessed: 2023-08--11."},{"key":"e_1_3_2_2_14_1","unstructured":"2023. A Research-Oriented Top Sites Ranking Hardened Against Manipulation. https:\/\/tranco-list.eu\/list\/JXP6Y\/1000000. Accessed: 2023-08--11."},{"key":"e_1_3_2_2_15_1","unstructured":"2023. Censys. https:\/\/search.censys.io\/search\/definitions?resource=hosts. Accessed: 2023-08--11."},{"key":"e_1_3_2_2_16_1","unstructured":"2023. Censys Search. https:\/\/search.censys.io\/. Accessed: 2023-08--11."},{"key":"e_1_3_2_2_17_1","unstructured":"2023. The CINS Score CI-Badguys list. https:\/\/cinsscore.com\/list\/ci-badguys.txt. Accessed: 2023-08--11."},{"key":"e_1_3_2_2_18_1","unstructured":"2023. The Darklist IP blacklist. https:\/\/darklist.de\/raw.php. Accessed: 2023-08--11."},{"key":"e_1_3_2_2_19_1","unstructured":"2023. Easily Identify Malicious Servers on the Internet with JARM. https:\/\/engineering.salesforce.com\/easily-identify-malicious-servers-onthe-internet-with-jarm-e095edac525a\/. Accessed: 2023-08--11."},{"key":"e_1_3_2_2_20_1","unstructured":"2023. Semi Automated Machine Learning Pipeline. https:\/\/github.com\/alexdrk14\/ SAMLP. Accessed: 23-06--23."},{"key":"e_1_3_2_2_21_1","unstructured":"2023. Shodan Facet Analysis. https:\/\/beta.shodan.io\/search\/facet?query=http& facet=ssl.jarm. Accessed: 2023-08--11."},{"key":"e_1_3_2_2_22_1","unstructured":"2023. Shodan Search Engine. https:\/\/www.shodan.io\/. Accessed: 2023-08--11."},{"key":"e_1_3_2_2_23_1","unstructured":"2023. SSLyze: A fast and powerful SSL\/TLS scanning tool. https:\/\/github.com\/ nabla-c0d3\/sslyze. Accessed: 2023-08--11."},{"key":"e_1_3_2_2_24_1","unstructured":"2023. TestSSL. https:\/\/testssl.sh\/. Accessed: 2023-08--11."},{"key":"e_1_3_2_2_25_1","unstructured":"2024. Dataset of paper \"Fingerprinting the Shadows: Unmasking Malicious Servers with Machine Learning-Powered TLS Analysis\". https:\/\/doi.org\/10.5281\/ zenodo.10655329. Accessed: 2024-02--18."},{"key":"e_1_3_2_2_26_1","doi-asserted-by":"publisher","DOI":"10.3844\/jcssp.2006.735.739"},{"key":"e_1_3_2_2_27_1","doi-asserted-by":"publisher","DOI":"10.1145\/3355369.3355601"},{"key":"e_1_3_2_2_28_1","doi-asserted-by":"publisher","DOI":"10.1007\/s11416-017-0306-6"},{"key":"e_1_3_2_2_29_1","volume-title":"Mercury: A network metadata tool for capturing and analysis. https:\/\/github.com\/cisco\/mercury. Accessed: 2023-08--11.","author":"Lucas Messenger Adam Weller Brandon Enright","year":"2019","unstructured":"Brandon Enright Lucas Messenger Adam Weller Andrew Chi Shekhar Achary Blake Anderson, David McGrew. 2019. Mercury: A network metadata tool for capturing and analysis. https:\/\/github.com\/cisco\/mercury. Accessed: 2023-08--11."},{"key":"e_1_3_2_2_30_1","volume-title":"Random forests. Machine learning 45","author":"Breiman Leo","year":"2001","unstructured":"Leo Breiman. 2001. Random forests. Machine learning 45 (2001), 5--32."},{"key":"e_1_3_2_2_31_1","unstructured":"Tianqi Chen Tong He Michael Benesty Vadim Khotilovich Yuan Tang Hyunsu Cho Kailong Chen Rory Mitchell Ignacio Cano Tianyi Zhou et al. 2015. Xgboost: extreme gradient boosting. R package version 0.4--2 1 4 (2015) 1--4."},{"key":"e_1_3_2_2_32_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICNP.2019.8888043"},{"key":"e_1_3_2_2_33_1","volume-title":"Blake Anderson and Philip Perricone","author":"David McGrew Bill Hudson","year":"2017","unstructured":"Bill Hudson David McGrew, Blake Anderson and Philip Perricone. 2017. Joy. https:\/\/github.com\/cisco\/joy. Accessed: 2023-08--11."},{"key":"e_1_3_2_2_34_1","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813703"},{"key":"e_1_3_2_2_35_1","doi-asserted-by":"publisher","DOI":"10.1007\/s00355-011-0603-9"},{"key":"e_1_3_2_2_36_1","doi-asserted-by":"publisher","DOI":"10.1080\/10361146.2014.900530"},{"key":"e_1_3_2_2_37_1","doi-asserted-by":"crossref","unstructured":"Sergey Frolov and Eric Wustrow. 2019. The use of TLS in Censorship Circumvention.. In NDSS.","DOI":"10.14722\/ndss.2019.23511"},{"key":"e_1_3_2_2_38_1","doi-asserted-by":"publisher","DOI":"10.1145\/3411740.3411742"},{"key":"e_1_3_2_2_39_1","doi-asserted-by":"publisher","DOI":"10.1007\/s00500-023-07949-9"},{"key":"e_1_3_2_2_40_1","volume-title":"Althouse and Josh Atkins","author":"Jeff Atkinson","year":"2017","unstructured":"Jeff Atkinson John B. Althouse and Josh Atkins. 2017. JA3. https:\/\/github.com\/ salesforce\/ja3. Accessed: 2023-08--11."},{"key":"e_1_3_2_2_41_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-981-16-8059-5_13"},{"key":"e_1_3_2_2_42_1","volume-title":"Revisiting TLSEncrypted Traffic Fingerprinting Methods for Malware Family Classification. In 2022 13th International Conference on Information and Communication Technology Convergence (ICTC)","author":"Kim Hyundo","unstructured":"Hyundo Kim, Minsu Kim, Joonseo Ha, and Heejun Roh. 2022. Revisiting TLSEncrypted Traffic Fingerprinting Methods for Malware Family Classification. In 2022 13th International Conference on Information and Communication Technology Convergence (ICTC). IEEE, 1273--1278."},{"key":"e_1_3_2_2_43_1","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM.2014.6848005"},{"key":"e_1_3_2_2_44_1","doi-asserted-by":"publisher","DOI":"10.1145\/3278532.3278568"},{"key":"e_1_3_2_2_45_1","volume-title":"NOMS 2020--2020 IEEE\/IFIP Network Operations and Management Symposium. IEEE, 1--6.","author":"Martin","year":"2020","unstructured":"Martin La?tovicka, Stanislav ?pacek, Petr Velan, and Pavel Celeda. 2020. Using TLS fingerprints for OS identification in encrypted traffic. In NOMS 2020--2020 IEEE\/IFIP Network Operations and Management Symposium. IEEE, 1--6."},{"key":"e_1_3_2_2_46_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00079"},{"key":"e_1_3_2_2_47_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2014.23218"},{"key":"e_1_3_2_2_48_1","doi-asserted-by":"publisher","DOI":"10.3390\/app12010155"},{"key":"e_1_3_2_2_49_1","doi-asserted-by":"publisher","DOI":"10.1145\/3457904"},{"key":"e_1_3_2_2_50_1","doi-asserted-by":"publisher","DOI":"10.1109\/ISCC58397.2023.10218210"},{"key":"e_1_3_2_2_51_1","doi-asserted-by":"publisher","DOI":"10.1145\/3487552.3487830"},{"key":"e_1_3_2_2_52_1","doi-asserted-by":"publisher","DOI":"10.1145\/3143361.3143400"},{"key":"e_1_3_2_2_53_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2962018"},{"key":"e_1_3_2_2_54_1","unstructured":"Ivan Ristic. 2009. HTTP Client Fingerprinting using SSL Handshake Analysis. https:\/\/blog.ivanristic.com\/2009\/06\/http-client-fingerprinting-using-sslhandshake-analysis.html. (2009). Accessed: 2023-08--11."},{"key":"e_1_3_2_2_55_1","unstructured":"Ivan Ristic. 2012. Sslhalf. https:\/\/github.com\/ssllabs\/sslhaf. Accessed: 2023-08--11."},{"key":"e_1_3_2_2_56_1","unstructured":"Donald G Saari. 1985. The optimal ranking method is the Borda Count. Technical Report. Discussion paper."},{"key":"e_1_3_2_2_57_1","doi-asserted-by":"publisher","DOI":"10.1109\/IWQOS52092.2021.9521272"},{"key":"e_1_3_2_2_58_1","volume-title":"BotArtist: Twitter bot detection Machine Learning model based on Twitter suspension. arXiv preprint arXiv:2306.00037","author":"Shevtsov Alex","year":"2023","unstructured":"Alex Shevtsov, Despoina Antonakaki, Ioannis Lamprou, Polyvios Pratikakis, and Sotiris Ioannidis. 2023. BotArtist: Twitter bot detection Machine Learning model based on Twitter suspension. arXiv preprint arXiv:2306.00037 (2023)."},{"key":"e_1_3_2_2_59_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-28486-1_6"},{"key":"e_1_3_2_2_60_1","volume-title":"Active TLS stack fingerprinting: characterizing TLS server deployments at scale. arXiv preprint arXiv:2206.13230","author":"Sosnowski Markus","year":"2022","unstructured":"Markus Sosnowski, Johannes Zirngibl, Patrick Sattler, Georg Carle, Claas Grohnfeldt, Michele Russo, and Daniele Sgandurra. 2022. Active TLS stack fingerprinting: characterizing TLS server deployments at scale. arXiv preprint arXiv:2206.13230 (2022)."},{"key":"e_1_3_2_2_61_1","volume-title":"Encyclopedia of machine learning 15, 1","author":"Webb Geoffrey I","year":"2010","unstructured":"Geoffrey I Webb, Eamonn Keogh, and Risto Miikkulainen. 2010. Na\u00efve Bayes. Encyclopedia of machine learning 15, 1 (2010), 713--714."},{"key":"e_1_3_2_2_62_1","doi-asserted-by":"publisher","DOI":"10.1145\/3357384.3357993"}],"event":{"name":"WWW '24: The ACM Web Conference 2024","location":"Singapore Singapore","acronym":"WWW '24","sponsor":["SIGWEB ACM Special Interest Group on Hypertext, Hypermedia, and Web"]},"container-title":["Proceedings of the ACM Web Conference 2024"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3589334.3645719","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3589334.3645719","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,8,22]],"date-time":"2025-08-22T00:30:33Z","timestamp":1755822633000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3589334.3645719"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,5,13]]},"references-count":62,"alternative-id":["10.1145\/3589334.3645719","10.1145\/3589334"],"URL":"https:\/\/doi.org\/10.1145\/3589334.3645719","relation":{},"subject":[],"published":{"date-parts":[[2024,5,13]]},"assertion":[{"value":"2024-05-13","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}