Server Certificate Features for Encrypted Malware Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing prevalence of encrypted network traffic poses challenges for intrusion protection systems as it obscures the contents of network traffic, making it difficult to detect and classify malicious activities such as malware propagation and data exfiltration using traditional deep packet inspection methods.
Innovation Solution
A network device analyzes server certificate data from encrypted traffic flows to extract features, which are used in a machine learning-based classifier to identify and attribute malware, leveraging characteristics like subjectAltName entries, certificate validity, and flow metrics to improve threat detection and classification accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional deep packet inspection methods are used to detect malicious traffic, then detection capability is maintained for unencrypted traffic, but detection effectiveness deteriorates when traffic is encrypted
Solution Approach 1:
The patent uses server certificate data as an intermediary to bridge the gap between encrypted traffic and detection capabilities. Instead of attempting to decrypt traffic or inspect contents directly, the system extracts features from server certificates (which are visible in encrypted TLS/SSL traffic) to classify and detect malware. This intermediary approach allows detection to function effectively with encrypted traffic without requiring decryption.
2Loss of information
If encrypted traffic is used to protect data privacy, then security and privacy are improved, but the ability to monitor and detect malicious activities deteriorates
Solution Approach 1:
The patent extracts detection-relevant features from server certificate data that is inherently present in encrypted traffic flows. By taking out and analyzing specific certificate attributes (such as subjectAltName entries, validity periods, and other metadata) without requiring access to the encrypted payload, the system maintains data privacy protection while enabling malicious activity detection through side-channel information.
3Measurement precision
If machine learning classification is applied to certificate data, then malware classification accuracy is improved, but system complexity increases
Solution Approach 1:
The patent transforms server certificate data into specific numerical features and parameters that can be processed by machine learning classifiers. By changing the representation of certificate data into structured feature vectors (extracting attributes like subjectAltName count, validity duration, etc.), the system enables accurate malware classification while managing complexity through standardized feature engineering rather than raw data processing.
Data Source
AI summary
In one embodiment, a device in a network receives certificate data for an encrypted traffic flow associated with a client node in the network. The device determines one or more data features from the certificate data. The device determines one or more flow characteristics of the encrypted traffic flow. The device performs a classification of an application executed by the client node and associated with the encrypted traffic flow by using a machine learning-based classifier to assess the one or more data features from the certificate data and the one or more flow characteristics of the traffic flow. The device causes performance of a network action based on a result of the classification of the application.