English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Malware abuses TLS to encrypt its malicious traffic, preventing examinationby content signatures and deep packet inspection. Network detection ofmalicious TLS flows is an important, but challenging, problem. Prior works haveproposed supervised machine learning detectors using TLS features. However, bytrying to represent all malicious traffic, supervised binary detectors producemodels that are too loose, thus introducing errors. Furthermore, they do notdistinguish flows generated by different malware. On the other hand, supervisedmulti-class detectors produce tighter models and can classify flows by malwarefamily, but require family labels, which are not available for many samples.  To address these limitations, this work proposes a novel unsupervisedapproach to detect and cluster malicious TLS flows. Our approach takes as inputnetwork traces from sandboxes. It clusters similar TLS flows using 90 featuresthat capture properties of the TLS client, TLS server, certificate, andencrypted payload; and uses the clusters to build an unsupervised detector thatcan assign a malicious flow to the cluster it belongs to, or determine it isbenign. We evaluate our approach using 972K traces from a commercial sandboxand 35M TLS flows from a research network. Our clustering shows very highprecision and recall with an F1 score of 0.993. We compare our unsuperviseddetector with two state-of-the-art approaches, showing that it outperformsboth. The false detection rate of our detector is 0.032% measured over fourmonths of traffic.

Unsupervised Detection and Clustering of Malicious TLS Flows