## 4 Machine Learning Pipeline for Passive Inspection of TLS-Encrypted Traffic
### TLS Flow Fingerprinting  
In practice, TLS fingerprint is an indicator of compromise (IoC) [95], which summarizes _one or more_ TLS flow records with the same label, where the label has a dependency on its problem domain (e.g., malware/benign in malware detection [96], a specific malware family in malware family classification [29], mobile app in mobile traffic classification [21], and user agent string in browser fingerprinting [97; 98]). Therefore, a TLS fingerprint can be used as a clarified input for machine learning algorithms in training/testing, as well as a model representation for a class (i.e., a specific label). A widely used and active TLS fingerprinting method is JA3 [99]. This MD5 hash-based TLS client fingerprinting technique was proposed by [PERSON], [PERSON], and [PERSON] of Salesforce in 2017 and named after its three authors with the same initials. A JA3 fingerprint summarizes SSL version, offering ciphersuite list, TLS extension list, and elliptic curve-related information in TLS ClientHello message of a TLS session with the MD5 hash function, while ignoring Google's GREASE (Generate Random Extensions And Sustain Extensibility) [100]. As an example, when we have a ClientHello message where the version field has value 0x0303 = 771 (i.e., TLS 1.2), the list of supported ciphersuites contains the following hyphen-separated values 4-5-10-9-100-98-3-6-19-18-99, and there is no TLS extension list and elliptic curve-related information, then the comma-concatenated string 771,4-5-10-9-100-98-3-6-19-18-99,, is the input of the MD5 hash function. The resulting JA3 fingerprint is 07571e689c94 dd5474350e204a2f3 ade. Note that for better visibility of malicious client-server combination (e.g., Tor client and Tor server), JA3S, a server-side version of JA3, was also proposed. Currently, various practical TLS fingerprinting databases, such as mod_sslhaf [101] from Qualys SSL Labs, pOf [102] of [PERSON], FingerPrinTLS [103] of [PERSON], and JA3-based OSINT feeds [33; 34] accumulate labeled TLS fingerprints in different goals (i.e., different types of labels), while all the databases are built for exact matching scenarios and tools. For example, ref. [99] recommends using JA3 for blacklist-based access control of TLS-encrypted malware traffic, and whitelist-based access control of legitimate applications in locked-down environments. However, despite its popularity, it is unclear whether JA3 is a reliable fingerprint for such scenarios, owing to the lack of evaluation results. To the best of our knowledge, ref. [104] is the only research on JA3's reliability. The authors insist that JA3 is not sufficient for mobile app identifications; however, a combination of JA3, JA3S, and SNI can improve reliability. Note that [PERSON] et al. [105] reported 7.3% fingerprint collision in their longitudinal passive dataset while applying a client fingerprinting technique similar to JA3. Meanwhile, in the literature, there are several proposals to adopt approximate, machine learning-based matching for TLS fingerprinting. [PERSON] and [PERSON] [90] propose using stochastic fingerprints for TLS-encrypted traffic in application classification. In this study, TLS message type sequences for each application to create a first-order homogeneous Markov chain fingerprint, and the classifier, is based on the maximum likelihood (ML) criterion. Inspired by [PERSON] and [PERSON] [106], [PERSON] and [PERSON] [107] utilized the Levenshtein distance for approximate matching when exact matching failed, even though the approach exhibits a worse performance than exact matching. Nevertheless, approximate matching should be further studied, considering the evolution of TLS-encrypted traffic for the same label. Additionally, Cisco joy and Cisco mercury provide the largest TLS fingerprint database labeled with potential (malicious or legitimate) application and operating system information, collected from malware sandbox and enterprise networks. However, it is not popularly adopted in the industry.