How to detect Malware in Encrypted Traffic Without Decryption
summary
Claims ability to label encrypted TLS flows as benign or malicious without decryption by fusing client hello fingerprints, SNI and five‑tuple context, packet‑length/time sequences and host telemetry. Uses the open source Mercury pipeline and a weighted Naive Bayes classifier trained on roughly 13 billion sessions including about 53 million malware sessions (ThreatGrid labels >=95). Production implementation runs daily updates, adds 10–20 new fingerprints, reports high accuracy with very low false positives and identifies process name, OS and malware score.
AI-written summary · about
chapters (10)
- 0:00Start
- 4:14Key Exchange 101
- 9:33Bypassing the Decrypting Device
- 10:26Other New Encryption Protocols
- 14:46Problem: Encrypted Malware Traffic
- 18:18Malware Domain Faking
- 24:23Cisco TLS Fingerprinting with Destination Context
- 25:44Initial Data Packet: TLS ClientHello
- 28:02Machine Learning Techniques
- 29:08Machine Learning in Practice
related talks
51mHow to Detect Malware in Encrypted Traffic WITHOUT Decryption
30mData Driven Security
27mA Machine Learning approach for detecting a Malware
48mCatch me if you can: Building a Web Malware Analyzer using Machine Learning
48mNothing but Net: Leveraging macOS's Networking Frameworks to Heuristically Detect Malware
49mLeveraging MacOS's Networking Frameworks to Heuristically Detect Malware
14mUnmasking the Lurking: Malicious Behavior Detection for IoT Malware with Multi-label(…)
40mAnalyzing Windows Malware on Linux: Getting Started Tips and Examples