Deciphering Malware's use of TLS (without Decryption) · HackerPapers discussions

Deciphering Malware's use of TLS (without Decryption) — mentioned by m-app

Tue, 15 Jan 2019 15:28:30 GMT

This is exactly what has been researched at multiple security companies and productized by Cisco under "Encrypted Traffic Analytics". This is based on research from 2016 that can be found on arXiv: https://arxiv.org/abs/1607.01639 > We conclude that malware's usage of TLS is distinct from benign usage in an enterprise setting, and that these differences can be effectively used in rules and machine learning classifiers. Disclaimer: I work for Cisco

Paper and discussion history. A mention is not an endorsement.

Deciphering Malware's use of TLS (without Decryption) — HN submission

Thu, 22 Jun 2017 10:20:42 GMT

Deciphering Malware's Use of TLS (without Decryption)

1 point; 0 discussion replies on HN. Paper and source history. A submission is not an endorsement.

Deciphering Malware's use of TLS (without Decryption) — HN submission

Wed, 21 Jun 2017 13:37:43 GMT

Deciphering Malware's Use of TLS (without Decryption)

3 points; 0 discussion replies on HN. Paper and source history. A submission is not an endorsement.

Deciphering Malware's use of TLS (without Decryption) — mentioned by anonymousDan

Wed, 05 Oct 2016 10:05:56 GMT

Could you elaborate a bit on what kind of passive DPI you can usefully do on an encrypted TLS session? Do you mean something like this? https://arxiv.org/pdf/1607.01639v1.pdf

Paper and discussion history. A mention is not an endorsement.