MDiET: Malware Detection in Encrypted Traffic

Abstract

With the increasing adoption of end-to-end encryption in industrial systems, the risk of distributing hidden malware by exploiting encrypted channels gradually turns to a major concern. Due to encryption, the stateof-the-art, signature-based mechanisms might fail to detect malware sufficiently, thus new approaches are required. In this work, a method for malware detection in encrypted traffic based on Machine Learning is presented. A supervised learning approach is adopted and the efficiency of the solution is demonstrated by a set of exhaustive simulations. Further considerations for incorporating the proposed method in a reference industrial network are also discussed.

Adaptive Traffic Fingerprinting: Large-scale Inference under Realistic Assumptions

“…Besides attacks, fingerprinting techniques have also found applications in malware detection in network settings [23], [16], [24], [25], [26]. Network administrators employ fingerprinting techniques to identify malware based on the TLS channels it establishes with its remote command & control servers (e.g., botnets using Twitter profiles to receive commands from their controllers [27], [28], [29], [30], [31]).…”