3 ms·

A few years ago, one of the best managers I ever worked for left to become the CTO of a company doing pattern analysis of network traffic, rather than Deep Pack

by mabbo 8y ago

A few years ago, one of the best managers I ever worked for left to become the CTO of a company doing pattern analysis of network traffic, rather than Deep Packet Inspection. The premise was that most of the internet traffic on your network follows the same typical patterns, but nefarious traffic doesn't. Drop their system into the network and voila, you can start to find the weird things going on that seem out of the ordinary. At the time, I thought that it seemed a bit heavy-handed- just use DPI and you'll get the same results. This article is making me think he was very prescient in the matter.

m-app 8y ago
This is exactly what has been researched at multiple security companies and productized by Cisco under "Encrypted Traffic Analytics". This is based on research from 2016 that can be found on arXiv: https://arxiv.org/abs/1607.01639 https://arxiv.org/abs/1607.01639 > We conclude that malware's usage of TLS is distinct from benign usage in an enterprise setting, and that these differences can be effectively used in rules and machine learning classifiers. Disclaimer: I work for Cisco
- vlovich123 8y ago
  Neat paper but as soon as this becomes more widespread malware authors are going to adapt to hide as regular traffic so the analysis is going to get more & more complex until it's not useful as malware traffic will look indistinguishable from real traffic. This is a fundamental evolutionary cat & mouse game that's impossible to win; antibiotics & bacteria, toxins in prey & toxicity resistance in predators, etc.
  - ap0phenia 8y ago
    & autoimmune diseases...
genpfault 8y ago
> Drop their system into the network and voila, you can start to find the weird things going on that seem out of the ordinary. hmmm[1] [1]: https://everything2.com/user/The+Custodian/writeups/Seek+And+You+Shall+Find https://everything2.com/user/The+Custodian/writeups/Seek+And...
xnyan 8y ago
The Chinese have been doing this for a age now, using pattern analysis to detect firewall avoidance methods. There of course have been developed anti pattern analysis methods and the fight goes on.
ajr0 8y ago
I find this is interesting however I cannot see businesses with important data to protect depending on this when decryption is a far safer option, there is no guessing what it is when on a corporate network you can simply decrypt the traffic and see what it is.
jsperx 8y ago
What was the name of the company? My management responsibility at work includes networks (by default, we are small) and I always say I don’t have to know/care that you’re using BitTorrent (encrypted/port shifting), so much as there’s an anomaly on the network impacting others. I’d rather have something flagging “hmm this is atypical” based on size/src/dst/ports then try to make rules ahead of time that might miss new trends.

by mabbo 8y ago

m-app 8y ago

This is exactly what has been researched at multiple security companies and productized by Cisco under "Encrypted Traffic Analytics". This is based on research from 2016 that can be found on arXiv: https://arxiv.org/abs/1607.01639 https://arxiv.org/abs/1607.01639 > We conclude that malware's usage of TLS is distinct from benign usage in an enterprise setting, and that these differences can be effectively used in rules and machine learning classifiers. Disclaimer: I work for Cisco

vlovich123 8y ago
Neat paper but as soon as this becomes more widespread malware authors are going to adapt to hide as regular traffic so the analysis is going to get more & more complex until it's not useful as malware traffic will look indistinguishable from real traffic. This is a fundamental evolutionary cat & mouse game that's impossible to win; antibiotics & bacteria, toxins in prey & toxicity resistance in predators, etc.
- ap0phenia 8y ago
  & autoimmune diseases...

genpfault 8y ago

> Drop their system into the network and voila, you can start to find the weird things going on that seem out of the ordinary. hmmm[1] [1]: https://everything2.com/user/The+Custodian/writeups/Seek+And+You+Shall+Find https://everything2.com/user/The+Custodian/writeups/Seek+And...

xnyan 8y ago

The Chinese have been doing this for a age now, using pattern analysis to detect firewall avoidance methods. There of course have been developed anti pattern analysis methods and the fight goes on.

ajr0 8y ago

I find this is interesting however I cannot see businesses with important data to protect depending on this when decryption is a far safer option, there is no guessing what it is when on a corporate network you can simply decrypt the traffic and see what it is.

jsperx 8y ago

What was the name of the company? My management responsibility at work includes networks (by default, we are small) and I always say I don’t have to know/care that you’re using BitTorrent (encrypted/port shifting), so much as there’s an anomaly on the network impacting others. I’d rather have something flagging “hmm this is atypical” based on size/src/dst/ports then try to make rules ahead of time that might miss new trends.