Analyzing encrypted traffic behavior using contextual traffic data

An apparatus, comprising:

• one or more network interfaces to communicate with a network;
• a processor coupled to the network interfaces and configured to execute one or more processes;
• and
• a memory configured to store a process executable by the processor, the process when executed operable to:
• detect an encrypted traffic flow associated with a client in the network;
• receive a sequence of packets sent by the client associated with the encrypted traffic flow, the sequence of packets including 1) an encrypted request packet of the encrypted traffic flow and 2) one or more unencrypted packets sent by the client sequentially before or after the encrypted request packet;
• capture contextual traffic data regarding the encrypted traffic flow from the one or more unencrypted packets;
• perform a classification of the encrypted traffic flow by using the captured contextual traffic data as input to a machine learning-based classifier;
• and
• generate an alert based on the classification of the encrypted traffic flow,
• wherein the apparatus further captures the contextual traffic data by:
• analyzing the encrypted traffic flow to infer a header field of the encrypted traffic flow;
• and
• comparing the inferred header field of the encrypted traffic flow with a header field of the one or more unencrypted packets.

A tangible, non-transitory, computer-readable medium storing program instructions that cause a networking device in a network to execute a process comprising:

• detecting, at the device, an encrypted traffic flow associated with a client in the network;
• receiving, at the device, a sequence of packets sent by the client associated with the encrypted traffic flow, the sequence of packets including 1) an encrypted request packet of the encrypted traffic flow and 2) one or more unencrypted packets sent by the client sequentially before or after the encrypted request packet;
• capturing, by the device, contextual traffic data regarding the encrypted traffic flow from the one or more unencrypted packets;
• performing, by the device, a classification of the encrypted traffic flow by using the captured contextual traffic data as input to a machine learning-based classifier;
• and
• generating, at the device, an alert based on the classification of the encrypted traffic flow wherein capturing the contextual traffic data further comprises:
• analyzing, by the device, the encrypted traffic flow to infer a header field of the encrypted traffic flow;
• and
• comparing, by the device, the inferred header field of the encrypted traffic flow with a header field of the one or more unencrypted packets.