Discussion: Deciphering Malware's Use Of TLS (Without Decryption)
The attached document is an interesting deep dive into threat modeling the potential of encrypted network traffic to be malicious based on it is meta data and use of TLS. Factors, like the client that was used (Mozilla, Tor, IE, Opera, etc.,), the cipher suite that was offered (RC4, DES, 3DES, AES, etc.).
What are your thoughts on the approach outlined in the article? Do you see any chance for false positives?
The response should include a reference list. Double-space, using Times New Roman 12 pnt font, one-inch margins, and APA style of writing and citations.
Article: Deciphering Malware's Use Of TLS (Without Decryption) by Blake Anderson, Subharthi Paul and David McGrew.