Server Certificate Fingerprinting for Encrypted Malware Attribution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing prevalence of encrypted network traffic poses challenges for intrusion protection systems as it obscures content, making it difficult to detect and classify malicious network traffic, such as malware, using traditional pattern matching methods.
Innovation Solution
A network device analyzes server certificate data from encrypted traffic flows to extract features, which are used in a machine learning-based classifier to identify and attribute malware applications, allowing for network actions based on the classification results.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional pattern matching methods are used to detect malicious traffic, then detection accuracy is improved, but the method becomes inapplicable to encrypted traffic
Solution Approach 1:
The patent uses server certificate data as an intermediary to bridge the gap between encrypted traffic and detection capabilities. Instead of attempting to decrypt or directly analyze encrypted payloads, the system extracts features from server certificates (which are visible in encrypted traffic) to infer application identity and malware classification, thus maintaining detection accuracy while adapting to encrypted traffic scenarios
Solution Approach 2:
The patent replaces the mechanical pattern matching approach (which requires visible traffic content) with a machine learning-based classification system that operates on certificate features. This substitution enables the system to handle encrypted traffic by using alternative data sources (certificate attributes) rather than direct content inspection
2Reliability
If encrypted traffic is used to protect data, then security is improved, but content analysis becomes unavailable for intrusion detection
Solution Approach 1:
The patent extracts useful information (server certificate data) from the encrypted traffic flow without requiring decryption of the actual content. By taking out and analyzing certificate features such as subject alternative names, validity periods, and issuer information, the system maintains data security through encryption while recovering sufficient information for malware detection and classification
Solution Approach 2:
Server certificates serve as an intermediary information source that provides indirect insights into the encrypted traffic's nature. The certificates contain metadata that reveals application identity and characteristics, allowing intrusion detection systems to analyze traffic content indirectly without compromising the confidentiality provided by encryption
Data Source
AI summary
In one embodiment, a device in a network receives certificate data for an encrypted traffic flow associated with a client node in the network. The device determines one or more data features from the certificate data. The device determines one or more flow characteristics of the encrypted traffic flow. The device performs a classification of an application executed by the client node and associated with the encrypted traffic flow by using a machine learning-based classifier to assess the one or more data features from the certificate data and the one or more flow characteristics of the traffic flow. The device causes performance of a network action based on a result of the classification of the application.