FINDING · DETECTION

Existing deep learning traffic classifiers, despite having millions of parameters, implement relatively simple logic based on TLS handshake header fields, which limits their robustness when encrypted protocols evolve to new versions. The paper identifies this as a fundamental limitation of the current state of encrypted traffic classification.

From 2022-akbari-traffic-classification-increasingly — Traffic classification in an increasingly encrypted web · Abstract · 2022 · Communications of the ACM

Implications

Protocol designers should anticipate that TLS-header-based classifiers will fail when ECH or future handshake changes obscure the fields they rely on — deliberately adopting new TLS extensions or randomizing extension ordering can exploit this brittleness.
Circumvention tools should rotate or randomize TLS handshake fields (cipher suites, extensions, GREASE) to break classifier assumptions trained on static header distributions.