You are presented with multiple paper abstracts, alongside the associated literature review and chapter titles. Given the provided information, you are going to do a literature review. Please generate a coherent literature review that synthesizes the content, draws connections between different works, highlights major findings, and identifies any gaps in the existing research.

Literature Review Title: A Survey of Methods for Encrypted Traffic Classification andAnalysis 
Chapter Title:  The Unencrypted Initialization Phase 
1. Abstract of Cited Paper (BIB001):  We report the results of a large-scale measurement study of the HTTPS certificate ecosystem---the public-key infrastructure that underlies nearly all secure web communications. Using data collected by performing 110 Internet-wide scans over 14 months, we gain detailed and temporally fine-grained visibility into this otherwise opaque area of security-critical infrastructure. We investigate the trust relationships among root authorities, intermediate authorities, and the leaf certificates used by web servers, ultimately identifying and classifying more than 1,800 entities that are able to issue certificates vouching for the identity of any website. We uncover practices that may put the security of the ecosystem at risk, and we identify frequent configuration problems that lead to user-facing errors and potential vulnerabilities. We conclude with lessons and recommendations to ensure the long-term health and security of the certificate ecosystem.

Literature Review:
Almost all network protocols ensure secure data transfer by means of encryption containing an unencrypted initialization phase, as depicted in Figure 1 . Because the data exchanged at this stage are not encrypted, they can be easily extracted and used for monitoring network traffic. Generally, two types of information common to most protocols can be extracted during this phase. The first type covers the connection itself, and its properties exchanged in the initial handshake. The second type covers communicating peers' identifiers which are exchanged in the authentication phase. During the initial handshake, parameters of a connection are negotiated, such cipher suites and which protocol version is used. This dynamic setting of the connection properties enables backward compatibility for different versions of software or is used to set a different level of security based on established security policies. Some examples of this are data authentication and compression in addition to encryption itself. The list of possible identifications, with references to algorithm specification for IPsec, TLS, SSH and other protocols, can be found in IANA Protocol Registries  . All of this information can be used for proper connection characterization and correct parsing of other packets in the rest of the connection. One interesting use of the information from the initial handshake is presented by client fingerprinting based on the provided cipher-suites. A large amount of cipher-suites types exists, which usually are not all implemented by the client's applications. Therefore, each application specifies the supported cipher-suites and also prefers using them during the initial handshake. This makes it possible to passively distinguish specific operating systems, web browsers and other applications, together with their versions, based only on the cipher-suites which they use. An example of such client fingerprinting, based on the SSL/TLS initial handshake, is presented by applications from SSL Labs  and p0f module  . The authentication phase represents the second source of information which can be easily extracted from secured network traffic. Unique identifiers of one or both communicating peers, optionally supplemented by additional data about them, are exchanged during this phase. For example, in the authentication phase of the SSH protocol, the server sends its public key to the user. The user must validate the key and verify that the server knows the appropriate private key  . Since this information is almost unique for each SSH server, it is possible to detect server changes or man-in-the-middle attacks on them by passive network traffic monitoring. A very good example of extracting information from communication peers is demonstrated by monitoring the authentication phase of the SSL/TLS protocol. The server, and optionally even the client, sends their X.509 certificates  to each other to verify their identities in this phase. This certificate contains a public key signed by the certification authority which is supplemented with information about the peer and issuer. More detailed content of such certificates is shown in Figure 5 . Monitoring passive certificates enables not only the identification of communicating peers but also the ability to check whether these certificates are valid and contains proper security algorithms to fulfil local security policies. SSL/TLS certificate properties were studied by Holz et al. BIB001 who revealed a great number of invalid certificates and some which were shared between a large number of hosts. Holz et al's work was followed by Durumeric et al. BIB002 who mainly focused on assessing certification authorities. Certificate monitoring can also be used to detect malicious software trying to hide its activities by connecting with their command and controls centres using the SSL/TLS protocol [65] .