How to Detect Malware in Encrypted Traffic WITHOUT Decryption
summary
Claims that metadata alone flags malware without decryption using TLS client hello fingerprints plus destination context and a weighted Naive Bayes classifier are backed by an open toolchain and large datasets. The pipeline extracts features with Project Mercury, combines AnyConnect NVM host telemetry and Cisco Threat Grid sandbox runs, trains on billions of flows including 33 million sandbox sessions, and reports malware detection up to 0.99 precision. An Encrypted Visibility Engine in Firepower demonstrates practical deployment.
AI-written summary · about
chapters (10)
- 0:00Detecting malware in encrypted traffic
- 1:15Encryption challenges malware detection
- 3:43How TLS encryption works
- 10:50TLS 1.3 SNI spoofing challenges
- 18:37Encryption trends visibility limits
- 22:50Malware tactics in encrypted traffic
- 27:06Benign vs malicious encrypted traffic
- 30:17TLS fingerprinting for clients
- 35:56Machine learning malware detection
- 46:30Conclusion and future
related talks
46mHow to detect Malware in Encrypted Traffic Without Decryption
48mNothing but Net: Leveraging macOS's Networking Frameworks to Heuristically Detect Malware
49mLeveraging MacOS's Networking Frameworks to Heuristically Detect Malware
48mCatch me if you can: Building a Web Malware Analyzer using Machine Learning
30mData Driven Security
50mTowards a Holistic Approach in Building Intelligence to Fight Crimeware
27mA Machine Learning approach for detecting a Malware
58mHunting Malware with Suricata Metadata