# A Novel TLS-Based Fingerprinting Approach That Combines Feature Expansion and Similarity Mapping
## 2 Related Work
### TLS Fingerprinting and the CDN Problem  
Content delivery networks are geographically distributed nodes designed to improve the speed and availability of content by moving it closer to the end user. They are increasingly being adopted to help with Distributed Denial Of Service (DDOS) attacks, and some CDN vendors have been instrumental in pioneering the early adoptions of technologies like ECH, with Cloudflare enabling the technology as recently as 2023 [11].  
The increasing adoption of CDNs has naturally had an impact on the statistics of TLS usage. According to the HTTP archive Web Almanac, 87% of sites using TLS now use the latest version compared to only 42% of non-CDN-origin sites [12]. This has been driven by the fact that the CDN handles the TLS termination at the edge and creates a second connection back to the origin. The fact that the CDN handles the termination means that TLS configurations are often no longer done by the origin server and, as the CDN can be configured to handle updates and configuration changes, more uniformity across TLS profiles is seen. [PERSON] et al. [13] discussed some of the issues faced when fingerprinting websites host behind CDNs. They highlighted the increased usage of CDNs, with 44% of the top 1 million sites now utilising them, and how the co-hosting of multiple domains behind a singular IP with the same TLS configuration creates a natural anonymity for the origin server. [PERSON] et al. [7] helped confirm the principal difficulties behind CDN identification focusing only on TLS metadata during their development of the Active TLS Stack fingerprinting tool. Their attempt to identify CDN deployments outside of a CDN's AS clearly highlighted the similarity between TLS fingerprints, with their research allocating specific fingerprints to several large CDN providers. Although the ranges of  
\begin{table}
\begin{tabular}{c c c} \hline
**ID** & **Extension** & **JARM** & **Active TLS** \\ \hline
1 & max\_fragment\_length & & \\ \hline
7 & client\_authentication & & \\ \hline
8 & server\_authentication & & \\ \hline
9 & cert\_type & & \\ \hline
10 & supported\_groups & & \\ \hline
11 & ec\_point\_formats & & \\ \hline
13 & signature\_algorithms & & \\ \hline
15 & heartbeat & & \\ \hline
16 & application\_layer\_protocol\_negotiation & & \\ \hline
19 & client\_certificate\_type & & \\ \hline
20 & server\_certificate\_type & & \\ \hline
23 & extended\_master\_secret & & \\ \hline
24 & token\_binding & & \\ \hline
27 & compress\_certificate & & \\ \hline
28 & record\_size\_limit & & \\ \hline
35 & session\_ticket & & \\ \hline
43 & supported\_versions & & \\ \hline
45 & psk\_key\_exchange\_modes & & \\ \hline
47 & certificate\_authorities & & \\ \hline
50 & signature\_algorithms\_cert & & \\ \hline
51 & key\_share (only selected group) & & \\ \hline
65281 & renegotiation\_info & & \\ \hline \end{tabular}
\end{table}
Table 1: The full TLS features used in both the JARM and ActiveTLS scan tools. The features used by each tool are highlighted in green; those not used are highlighted in grey.  
fingerprints were small in some cases, such as Alibaba being assigned only 1 fingerprint, Cloudflare was allocated 801 fingerprints, more than would be expected for a provider deploying TLS-enabled servers at scale.