Malware in encrypted traffic uncovered with machine learning

Detecting malware activity in encrypted traffic was thought to be an impossible task, but machine learning appears to have led to a working technique.

Blake Anderson, a technical leader at Cisco, and David McGrew, a Fellow in the company's Advanced Security Research Group, said it isn't possible to look into encrypted traffic, but the two developed a machine learning model that studied data features in "TLS handshake metadata, DNS contextual flows linked to the encrypted flow, and the HTTP headers of HTTP-contextual flows" in order to see the difference in how these encrypted traffic streams were used differently in malicious and benign scenarios.

According to an article posted by Cisco, and written by Jason Deign, the technique is called Encrypted Traffic Analytics (ETA) and "involves looking for telltale signs in three features of encrypted data.”