METADATA ANALYSIS OF ENCRYPTED TRAFFIC TO ELIMINATE SECURITY «BLIND SPOTS» OF MODERN INFORMATION SYSTEMS

Abstract

A review of recent developments is offered on the issues in the complex analysis of encrypted network traffic in modern information systems. The main research methods are: - analysis, generalization and comparison. The paper considers the issue of finding possible ways to ensure a compromise in the conditional triangle of «influence factors» when solving the tasks of operational detection of dangers in the data structure of encrypted traffic. As «influence factors» a combination of the following factors is considered: - the need to ensure the required level of Information Security (IS); - support for the right of users to their confidentiality; - resource consensus of the implemented software and hardware solutions. Attention is drawn to the fact that the integration of artificial intelligence and machine learning (AI/ML) technologies into the structure of network traffic control algorithms is a key lever for influencing the final result. It is emphasized that the opposing party will also use these technologies to mask its activities. It is concluded that the implementation of procedures for analyzing network traffic metadata is a compromise solution. The implementation of such an approach allows to improve the «transparency» of current network activity for early detection of security threats, without directly resorting to traffic decryption procedures. It is emphasized that the implementation of the «Cyber Deception» paradigm and a comprehensive analysis of the metadata of circulating encrypted traffic are a promising vector of efforts for preventive elimination of the prerequisites of the formation of "blind spots" in the security of modern IT systems.