Detection of Anomalous Encrypted Traffic

With the advances in Internet techniques, many applications have been developed which are not using secure mechanisms. Intrusion detection systems (IDS) are developed to analyse network traffic and identify unauthorised accesses and vulnerable applications. Nowadays, IDS are ineffective against attacks targeted at encrypted protocols because they depend on inspecting payload contents. Therefore, in this chapter we deal with anomaly detection models developed to defend attacks against encrypted protocols. In this chapter, we will discuss the attacks targeting Secure Socket Shell (SSH) and HyperText Transfer Protocol Secure (HTTPS) protocols and their prevention mechanism on public datasets and their performance.