  Network fingerprinting is used to identify applications, provide insight into
network traffic, and detect malicious activity. With the broad adoption of TLS,
traditional fingerprinting techniques that rely on clear-text data are no
longer viable. TLS-specific techniques have been introduced that create a
fingerprint string from carefully selected data features in the client_hello to
facilitate process identification before data is exchanged. Unfortunately, this
approach fails in practice because hundreds of processes can map to the same
fingerprint string. We solve this problem by presenting a TLS fingerprinting
system that makes use of the destination address, port, and server name in
addition to a carefully constructed fingerprint string. The destination context
is used to disambiguate the set of processes that match a fingerprint string by
applying a weighted naive Bayes classifier, resulting in far greater
performance.
