Automated Host Identification Using SSL/TLS Traffic with SHAP and Artificial Bee Colony

This paper introduces an automated method for identifying hosts that uses SSL/TLS (Secure Sockets Layer/Transport Layer Security) technology. We specifically test our method on identifying IoT devices. The method employs the SHAP (SHapley Additive exPlanations) and Artificial Bee Colony (ABC) algorithms for automated feature selection. Specifically, we analyze SSL/TLS handshake packets, which provide more distinguishing information than other SSL/TLS packets for device fingerprinting. Our experiments show that IP, TCP, and SSL/TLS features significantly enhance identification accuracy. Using SHAP and ABC, we achieved an accuracy of 98.9% with only 12 of 63 features, surpassing 98.4% accuracy with 22 features using ABC alone. Our approach significantly outperformed the JA3 hashing method, boosting identification accuracy from around 18 % to 98.9%. Furthermore, our approach performs well with non-handshake SSL/TLS packets, achieving up to 97% accuracy utilizing any SSL/TLS packet. These results demonstrate the efficiency and flexibility of our method, indicating its potential to significantly improve security protocols, providing a scalable and robust solution for host identification.