解密恶意软件对TLS的使用（不解密）
Deciphering Malware's use of TLS (without Decryption)
摘要：
恶意软件使用TLS对网络威胁检测提出了新的挑战，因为传统的模式匹配技术不再适用于其消息。然而，TLS还引入了一组复杂的可观察数据特征，允许对客户端和服务器进行许多推断。我们表明，这些功能可用于检测和理解恶意软件通信，同时保护加密的良性使用的隐私。这些数据特征还允许网络通信的准确恶意软件家族归属，即使仅限于单个加密流。为了证明这一点，我们对TLS如何被恶意软件和企业应用程序使用进行了详细的研究。我们提供了对数百万TLS加密流的一般分析，以及对18个恶意软件家族的有针对性的研究，这些恶意软件家族由数千个独特的恶意软件样本和数万个恶意TLS流组成。重要的是，我们识别并适应使用恶意软件沙箱所带来的偏见。恶意软件分类器的性能与恶意软件家族对TLS的使用相关，即，积极发展其密码学使用的恶意软件家族更难以分类。我们的结论是，恶意软件的TLS的使用是不同的良性使用在企业环境中，这些差异可以有效地用于规则和机器学习分类器。
英文摘要：
The use of TLS by malware poses new challenges to network threat detection because traditional pattern-matching techniques can no longer be applied to its messages. However, TLS also introduces a complex set of observable data features that allow many inferences to be made about both the client and the server. We show that these features can be used to detect and understand malware communication, while at the same time preserving the privacy of benign uses of encryption. These data features also allow for accurate malware family attribution of network communication, even when restricted to a single, encrypted flow. To demonstrate this, we performed a detailed study of how TLS is used by malware and enterprise applications. We provide a general analysis on millions of TLS encrypted flows, and a targeted study on 18 malware families composed of thousands of unique malware samples and ten-of-thousands of malicious TLS flows. Importantly, we identify and accommodate the bias introduced by the use of a malware sandbox. The performance of a malware classifier is correlated with a malware family's use of TLS, i.e., malware families that actively evolve their use of cryptography are more difficult to classify. We conclude that malware's usage of TLS is distinct from benign usage in an enterprise setting, and that these differences can be effectively used in rules and machine learning classifiers.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
