## 2 Background
### Basics of SSL/TLS  
SSL is the de facto standard Internet protocol used to establish secure end-to-end sessions over transmission control protocol (TCP) for providing communications privacy. According to the final draft of SSL 3.0 [35], SSL was designed to prevent several security attacks, such as eavesdropping, tampering, and message forgery. However, SSL 3.0 was deprecated in June 2015 [36]. TLS is the successor of SSL with backward compatibility with SSL, which was firstly published in RFC 2246 [37] in 1999. The current up-to-date version of TLS is TLS 1.3, defined in RFC 8446 [38]. However, a few of its previous versions (i.e., TLS 1.0 and TLS 1.1) were deprecated in March 2021 [39]. According to a report by Qualys SSL Labs [40] in October 2021, 99.6% of the surveyed websites support TLS 1.2 [41], and approximately half \begin{table}
\begin{tabular}{p{42.7 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Survey** & **Protocols** & **Problem Domains** & **Methods** & **Notes** \\ \hline \multirow{2}{*}{[18]} & \multirow{2}{*}{Various} & \multirow{2}{*}{Various} & \multirow{2}{*}{Various} & \(\bullet\) Comprehensive and up-to-date survey on encrypted \\  & & & & NTA methods \\  & & & & Nsufficient detail for the security domain \\ \hline \multirow{2}{*}{[19]} & \multirow{2}{*}{Various} & \multirow{2}{*}{Various} & \multirow{2}{*}{ML-based only} & \(\bullet\) Comprehensive survey on ML-based methods \\  & & & & \(\bullet\) Omits recent works for encrypted malware traffic \\ \hline \multirow{2}{*}{[20]} & \multirow{2}{*}{Various} & \multirow{2}{*}{Various} & \multirow{2}{*}{Various} & \(\bullet\) The first in encrypted traffic analysis area \\  & & & & \(\bullet\) Published in 2015 so that lacks the state-of-the-art \\ \hline \multirow{2}{*}{[21]} & \multirow{2}{*}{Various} & \multirow{2}{*}{Mobile Apps} & \multirow{2}{*}{DL-based only} & \(\bullet\) Experimental evaluation among existing DL-based methods \\  & & & & \(\bullet\) The most comprehensive for mobile traffic \\  & & & & \(\bullet\) May not suitable for many SOCs protecting servers \\ \hline \multirow{2}{*}{[23]} & \multirow{2}{*}{Various} & \multirow{2}{*}{Detection} & \multirow{2}{*}{Various} & \(\bullet\) Comprehensive survey on privacy preserving inspection \\  & & & & \(\bullet\) Too little coverage on ML-based methods \\ \hline \multirow{2}{*}{[24]} & \multirow{2}{*}{Various} & Traffic Classification & \multirow{2}{*}{DL-based only} & \(\bullet\) Brief overview on DL-based methods \\  & & & & \\ \hline \multirow{2}{*}{[25]} & \multirow{2}{*}{Various} & Website fingerprinting & Feature selection only & \(\bullet\) Brief overview on ML-based methods \\  & & & & \(\bullet\) Focus on website fingerprinting dataset \\ \hline \multirow{2}{*}{[26]} & \multirow{2}{*}{HTIPS} & Web Apps & Various & \(\bullet\) Services identification inside HTTPS \\  & & & & \(\bullet\) Industry practices analysis of TLS interception \\ \hline \multirow{2}{*}{This Paper} & \multirow{2}{*}{TLS} & \multirow{2}{*}{Malware Traffic} & Various, focusing on ML-based & \(\bullet\) The state-of-the-art for ML-based malware detection and family classification \\ \hline \hline \end{tabular}
\end{table} 
Table 1: A comparison of this paper with other related surveys, where ML refers machine learning and DL refers deep learning. (49.7%) of the websites support TLS 1.3, while less than a half support TLS 1.0 and TLS 1.1. Therefore, unless explicitly specified, we have primarily focused on TLS 1.2 in this survey. Following the TCP connection establishment procedure performed between two endpoints, a TLS session is initiated by one endpoint by sending a ClientHello message, and such endpoint is referred to as the client of the TLS session. The ClientHello message contains the client's TLS version, a list of supported ciphersuites (i.e., cryptographic options) ordered by preference of the client, and a list of requested extensions (i.e., extended functionality from servers), such as server name indication (SNI) extension defined in RFC 6066 [42].