Skip to content

Adaptive Methods and Tools for Shallow Packet Inspection in Anomaly Detection within Encrypted Network Traffic

Aug 2026 · Programming and computer software · Vol 52, pp. 385 - 392 · 0 citations · 14 references
Computer Science

TL;DR

A lightweight, kernel-level SPI framework implemented as a driver for the Hyper-V Extensible Switch, named RuStatExt, which aggregates network traffic into flows and extracts statistical features with negligible performance overhead is proposed, which introduces no statistically significant degradation in network throughput for either TCP or UDP traffic.

View source

Similar papers

Preprint Sep 2026

Improving the Reliability of Anomaly Detection for Encrypted OPC UA Traffic over Private 5G

Open Platform Communications Unified Architecture (OPC UA) is increasingly deployed over private 5G networks in industrial environments, where end-to-end encryption prevents payload inspection by network-based intrusion detection systems (IDSs). Although payload-agnostic statistical features extracted from encrypted tr...

Son-Ha Song, Florian Foerster, Henry Beuster et al. · 0 citations
Open access Aug 2026

Enhancing SQL Injection Detection: A Machine Learning Approach Using Network Flow Data

A flow-based detection method, making use of lightweight protocols like NetFlow and sFlow to identify SQLI attacks, which minimizes the need for computationally expensive packet inspection, which is going to render the process of detection more trustworthy and economical, particularly within high-traffic conditions.

P. Vinoth, K. Sudar, S. Muthukumar · 0 citations

Real-time detection of cryptographic key misuse in software-defined networks using incremental learning

An incremental learning based framework to detect anomalous traffic patterns which may indicate any key misuse in Software-Defined Networks in dynamic and real-time environments in modern SDN environments is proposed.

Gineeth Rajeshkhanna, Tamilarasi Kathirvel Murugan, Logeswari Govindaraj et al. · 0 citations
Conference Aug 2026

NetBERT: Transformer-Driven Robust Intrusion Detection Across Multi-Domain Network Traffic

Encrypted communication protocols are increasingly being leveraged to evade traditional Intrusion Detection Systems (IDS), particularly through techniques such as DNS tunneling and DNS over HTTPS (DoH).However, the existing frameworks primarily focused on non-encrypted attack traffic and are operated as a black-box mod...

Rhithika M. Pradeep, Ron Binoy Mechery, Sreerag K et al. · 0 citations
Review Open access Aug 2026

Encrypted-Traffic Detection in the TLS 1.3 Era: A Comprehensive Review and Future Research Directions

The synthesis identifies behavioural–statistical fusion as a promising research direction; however, its effectiveness remains empirically unvalidated as an integrated framework and future research should prioritise reproducible datasets, cross-environment and adversarial evaluation, and lightweight, interpretable detec...

Hazem Abu-Adaiq, Mahesh Biswas, Ahmad Y. Alnajjar et al. · 0 citations
Preprint Aug 2026

XNET: Intelligent Dynamic Sampling for High-Speed Network Security Monitoring

This paper introduces XNET, a system that monitors traffic at line rate using commodity hardware and applies dynamic sampling to amplify the visibility of high security value traffic and demonstrates XNET's scalability up to 100Gbps.

Thomas Papastergiou, Karthika Subramani, Joseph W. Reilly et al. · 0 citations

We use cookies to run the site and, with your consent, for analytics and to show ads. See our Cookie Policy.