| Abstract [eng] |
Deep packet inspection is a technology that can be used for reasons varying from local network protection and monitoring to internet censorship. The algorithms that can be applied are actively researched, and mostly are focused on the improvement of the data structures that can be employed. As the percentage of encrypted internet traffic increases, and some algorithms become less usable. There is a need for other methods of packet analysis that do not disrupt encryption. One of the methods is web traffic fingerprinting. It allows websites and mobile apps to be identified from their traffic patterns. This idea has been experimented with various protocols, including HTTP/1.1 and HTTP/2. This work tries web traffic fingerprinting with HTTP/3, newest HTTP protocol which is yet to be finalized. In result, it was shown that HTTP/3 web traffic can be fingerprinted with similar accuracy as traffic of other HTTP protocols, when considering some aspects of the protocol. It was found that it must be taken into consideration that HTTP/3 traffic is more encrypted and some things as acknowledgement packets must be detected statistically in order to increase accuracy of fingerprinting methods. |
