# Fine-Grained High-Utility Dynamic Fingerprinting Extraction for Network Traffic Analysis
## 3 Data Processing
### SSI/TLS Encryption Protocol and Communication Process
#### 3.1.3 Data Transmission  
In this phase, the data that the user needs to transfer are transferred in the application data format.  
The communication process shown in Figure 2 is the first complete communication process between the client and server. The actual use of encrypted communication is a continuous process. Exchanging keys and certificates for each communication consumes resources and is unnecessary. The server will retain the session ID of communication with the client for a while and wait for the client to continue using the previous session. Ifthe session ID of the client cannot be found in the existing list of the server, the server initiates a new session and performs a complete handshake. Figure 3 shows a simplified TLS communication process.  
As shown in Figures 2 and 3, different messages are required at different stages of communication establishment. Each message has a specific format and performs certain functions. In practical applications, programmers generally implement the communication between client and server according to protocol requirements, but also make some adjustments according to function requirements, for example, omitting some unnecessary messages or combining multiple packets to improve communication efficiency. The diversity of messages in communication and the flexibility in practice makes it possible to extract fingerprint features. Table 1 lists all message types and functions of the TLS Handshake Protocol.  
The notations in the right-most column of Table 1 are used to describe the communication process. The research object of this paper is encrypted traffic, but in actual network data, common protocols are used to complete some unimportant communication between  
Figure 3: The simplified process of TLS communication.  
Figure 2: The communication process of Handshake Protocol.  
client and server. The entire network data is a mixture of encrypted and non-encrypted protocols. Figure 4 shows the hierarchy of common protocols in the network.  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Protocol** & **Message Type** & **Message Function** & **Notation** \\ \hline Change Cipher Spec  Protocol & ChangeCipherSpec & Both the client and server can send a message to inform each other that the data to be transmitted will be encrypted with the new key. & 21: \\ \hline \multirow{4}{*}{Alert Protocol} & Closure Alerts & Notify the other party that no more data will be sent under the current connection. & 22:1 \\ \cline{2-4}  & Error Alerts & The communication parties immediately close the current connection and clear related information, such as the key and session ID. & 22:2 \\ \hline \multirow{4}{*}{Hello Messages} & \multirow{2}{*}{Hello Request} & Sent by the server to inform the client that a new communication negotiation process should be established. & 23:1 \\ \cline{2-4}  & & & \\ \cline{2-4}  & & & \\ \cline{2-4}  & & & \\ \cline{2-4}  & & & \\ \cline{2-4}  & & & \\ \cline{2-4}  & & & \\ \cline{2-4}  & & & \\ \cline{2-4}  & & & \\ \cline{2-4}  & & & \\ \cline{2-4}  & & & \\ \cline{2-4}  & & & \\ \cline{2-4}  & & & \\ \cline{2-4}  & & & \\ \cline{2-4}  & & & \\ \cline{2-4}  & & & \\ \cline{2-4}  & & & \\ \cline{2-4}  & & & \\ \cline{2-4}  & & & \\ \cline{2-4}  & & & \\ \cline{2-4}  & & & \\ \hline \hline \end{tabular}
\end{table}
Table 1: The messages of TLS Protocol.  
Figure 4: The architecture of protocols.  
This section describes the communication process between the client and server by analyzing TLS protocol contents and analyzing communication messages. After marking each message, one can prepare for fingerprinting extraction.