Keyword Mining for Private Protocols Tunneled Over WebSocket

WebSocket is a promising technique to build a real-time low-cost bidirectional communication channel. It supports arbitrary application-layer protocols including privately designed ones. The use of WebSocket poses a new challenge to network traffic management and security inspection. To increase visibility for WebSocket traffic, this letter proposes an automatic keyword mining approach for protocols tunneled over WebSocket. First, we extract keyword candidates based on an intuition that a specific keyword would appear frequently in different messages but would not appear many times in one message. Then, a hidden semi-Markov model is built to portray both temporal and spatial position relations of keywords in traffic. With the help of the well-trained model, we single out genuine keywords in the sense of maximum likelihood. Experiments on an instant messaging application validate the proposed method.