approach
enabling hosts to effectively assess the validity of the certificates they encounter during TLS
interactions. The system relies on the existence of a set of network probes located in different
elements of the network (either hosts or switches or routers), a distributed analysis engine based
on Bayesian networks and a reaction subsystem which makes use of SDN technologies.
Right now we have fully implemented the network probes and developed a proof-of-concept
scenario of the complete architecture. Although the system looks promising, there is still
considerable work to be done to build realistic Bayesian networks specifically tailored to realistic
high-sensitive network scenarios. This would result in early detection of suspicious certificate
and would trigger mechanisms to defeat the attack, minimize its impact, and gather information
on the attackers. Additionally, a more detailed and thorough analysis could be performed. This
would be achieved through the use of Software Defined Network (SDN) techniques, allowing
a much more accurate and efficient response to man-in-the-middle attacks, and mitigating
damage in highly sensitive communication networks.