Hacker News Reader

Comment by mabbo | Hacker News Reader

A few years ago, one of the best managers I ever worked for left to become the CTO of a company doing pattern analysis of network traffic, rather than Deep Packet Inspection. The premise was that most of the internet traffic on your network follows the same typical patterns, but nefarious traffic doesn't. Drop their system into the network and voila, you can start to find the weird things going on that seem out of the ordinary.

At the time, I thought that it seemed a bit heavy-handed- just use DPI and you'll get the same results. This article is making me think he was very prescient in the matter.

View on HN

This is exactly what has been researched at multiple security companies and productized by Cisco under "Encrypted Traffic Analytics". This is based on research from 2016 that can be found on arXiv: https://arxiv.org/abs/1607.01639

> We conclude that malware's usage of TLS is distinct from benign usage in an enterprise setting, and that these differences can be effectively used in rules and machine learning classifiers.

Disclaimer: I work for Cisco

Neat paper but as soon as this becomes more widespread malware authors are going to adapt to hide as regular traffic so the analysis is going to get more & more complex until it's not useful as malware traffic will look indistinguishable from real traffic.

This is a fundamental evolutionary cat & mouse game that's impossible to win; antibiotics & bacteria, toxins in prey & toxicity resistance in predators, etc.

& autoimmune diseases...

The Chinese have been doing this for a age now, using pattern analysis to detect firewall avoidance methods. There of course have been developed anti pattern analysis methods and the fight goes on.

What was the name of the company? My management responsibility at work includes networks (by default, we are small) and I always say I don’t have to know/care that you’re using BitTorrent (encrypted/port shifting), so much as there’s an anomaly on the network impacting others. I’d rather have something flagging “hmm this is atypical” based on size/src/dst/ports then try to make rules ahead of time that might miss new trends.

> Drop their system into the network and voila, you can start to find the weird things going on that seem out of the ordinary.

hmmm[1]

[1]: https://everything2.com/user/The+Custodian/writeups/Seek+And...

I find this is interesting however I cannot see businesses with important data to protect depending on this when decryption is a far safer option, there is no guessing what it is when on a corporate network you can simply decrypt the traffic and see what it is.

Reply on news.ycombinator.com