Exploring QUIC Dynamics: A Large-Scale Dataset for Encrypted Traffic Analysis

2024-09-30

arXiv.org

AI Summary

Existing QUIC encrypted traffic datasets suffer from limited scale, incomplete metadata, and lack of controllable decryption capabilities, hindering robust benchmark evaluation. This paper introduces VisQUIC: the first open-source, cross-implementation (Chromium/mvfst/quiche), long-term collected, large-scale labeled QUIC dataset, comprising 100,000 HTTP/3 traffic traces from over 44,000 websites, with SSL key–enabled controllable decryption. We propose a novel temporal imaging representation method based on observable packet-level features and integrate a standardized evaluation toolkit. On the HTTP/3 response-type classification task, our approach achieves 97% accuracy using encrypted packet features alone—without decryption. VisQUIC establishes a reproducible, scalable, and extensible benchmark for encrypted traffic analysis, QUIC protocol security assessment, and network monitoring research.

Technology Category

• Computer Vision: Large Vision Models
• Machine Learning: Calibration & Uncertainty Quantification
• Data Mining & Knowledge Management: Representing, Reasoning, and Using Provenance, Trust

Application Category

• Security and Privacy: Large-scale security measurements
• Responsible Web: Measurement, analysis, and circumvention of Web censorship
• Economics, Online Markets and Human Computation: Data quality aspects of human-annotated datasets

Abstract

The increasing adoption of the QUIC transport protocol has transformed encrypted web traffic, necessitating new methodologies for network analysis. However, existing datasets lack the scope, metadata, and decryption capabilities required for robust benchmarking in encrypted traffic research. We introduce VisQUIC, a large-scale dataset of 100,000 labeled QUIC traces from over 44,000 websites, collected over four months. Unlike prior datasets, VisQUIC provides SSL keys for controlled decryption, supports multiple QUIC implementations (Chromium QUIC, Facebooks mvfst, Cloudflares quiche), and introduces a novel image-based representation that enables machine learning-driven encrypted traffic analysis. The dataset includes standardized benchmarking tools, ensuring reproducibility. To demonstrate VisQUICs utility, we present a benchmarking task for estimating HTTP/3 responses in encrypted QUIC traffic, achieving 97% accuracy using only observable packet features. By publicly releasing VisQUIC, we provide an open foundation for advancing encrypted traffic analysis, QUIC security research, and network monitoring.

Problem

• Analyzing QUIC encrypted traffic dynamics
• Lack of comprehensive datasets for benchmarking
• Developing machine learning for traffic analysis

Innovation

• Large-scale labeled QUIC traces
• SSL keys for controlled decryption
• Image-based machine learning analysis