Malware classification and attribution through server fingerprinting using server certificate data

An apparatus, comprising:

• one or more network interfaces to communicate with a network;
• a processor coupled to the network interfaces and configured to execute one or more processes;
• and
• a memory configured to store a process executable by the processor, the process when executed operable to:
• obtain certificate data of a presently encrypted traffic flow sent from a client node in the network to a remote server, wherein the device is an intermediary device between the client node and the remote server that passively intercepts the certificate data of the encrypted traffic flow without a man-in-the-middle;
• determine one or more data features from the certificate data of the encrypted traffic flow;
• determine one or more flow characteristics of the encrypted traffic flow;
• perform a classification of an application executed by the client node and associated with the encrypted traffic flow by using a machine learning-based classifier to assess the one or more data features from the certificate data of the encrypted traffic flow and the one or more flow characteristics of the encrypted traffic flow, wherein the machine learning classifier assesses the certificate data of the encrypted traffic flow without decrypting the encrypted traffic flow;
• and
• cause performance of a network action based on a result of the classification of the application.

A tangible, non-transitory, computer-readable medium storing program instructions that cause a networking device in a network to execute a process comprising:

• obtaining, by a device in a network, certificate data of a presently encrypted traffic flow sent from a client node in the network to a remote server, wherein the device is an intermediary device between the client node and the remote server that passively intercepts the certificate data of the encrypted traffic flow without a man-in-the-middle;
• determining, by the device, one or more data features from the certificate data of the encrypted traffic flow;
• determining, by the device, one or more flow characteristics of the encrypted traffic flow;
• performing, by the device, a classification of an application executed by the client node and associated with the encrypted traffic flow by using a machine learning-based classifier to assess the one or more data features from the certificate data of the encrypted traffic flow and the one or more flow characteristics of the encrypted traffic flow, wherein the machine learning classifier assesses the certificate data of the encrypted traffic flow without decrypting the encrypted traffic flow;
• and
• causing, by the device, performance of a network action based on a result of the classification of the application.