Creating a security inspection layer for QUIC with pattern recognition

Sammanfattning

The Quick UDP Internet Connections (QUIC) protocol has emerged as modern internet trans-port protocol that offers improved performance and strong encryption compared to its predecessors.However, it still presents limits for network security inspection.This study investigates whether metadata-based traffic analysis can be used to detect maliciousbehavior in QUIC traffic without decrypting the payload and without the use of Machine Learning(ML). A rule-based detection system was implemented as a security inspection layer on top of a QUICserver that was built using the aioquic library. The system analyses observable metadata such as re-quest rate, stream count and packet size.With a result of 75% accuracy on average, the result shows that it is possible to a certain extentto determine whether QUIC traffic is malicious or not, without the use of ML and without decryptingand revealing the payloads content.