Correlating endpoint and network views to identify evasive applications

An apparatus, comprising:

• one or more network interfaces to communicate with a network;
• a processor coupled to the one or more network interfaces and configured to execute one or more processes;
• and
• a memory configured to store a process executable by the processor, the one or more processes when executed configured to:
• receive traffic telemetry data regarding encrypted traffic sent by an endpoint device in a network, wherein the traffic telemetry data is indicative of one or more of:
• a user agent parameter of the encrypted traffic, a ciphersuite offered by the endpoint device, a Transport Layer Security (TLS) extension used by the encrypted traffic, sequence of packet lengths and time (SPLT) data regarding the encrypted traffic, sequence of application lengths and time (SALT) data regarding the encrypted traffic, and byte distribution (BD) data regarding the encrypted traffic;
• analyze the traffic telemetry data to infer an identity of an application on the endpoint device that sent the encrypted traffic;
• receive, from a monitoring agent on the endpoint device, application telemetry data regarding the application;
• determine that the application is evasive malware based on the identity of the application inferred from the traffic telemetry data and on the application telemetry data received from the monitoring agent on the endpoint device by:
• determining an identity of the application based on the application telemetry data received from the monitoring agent on the endpoint device, and
• comparing the identity of the application determined based on the application telemetry data with the identity of the application inferred from the traffic telemetry data;
• and
• initiate performance of a mitigation action in the network, after determining that the application on the endpoint device is evasive malware.

A tangible, non-transitory, computer-readable medium that stores program instructions causing a service to execute a process comprising:

• receiving, at a service, traffic telemetry data regarding encrypted traffic sent by an endpoint device in a network, wherein the traffic telemetry data is indicative of one or more of:
• a user agent parameter of the encrypted traffic, a ciphersuite offered by the endpoint device, a Transport Layer Security (TLS) extension used by the encrypted traffic, sequence of packet lengths and time (SPLT) data regarding the encrypted traffic, sequence of application lengths and time (SALT) data regarding the encrypted traffic, and byte distribution (BD) data regarding the encrypted traffic;
• analyzing, by the service, the traffic telemetry data to infer an identity of an application on the endpoint device that sent the encrypted traffic;
• receiving, at the service and from a monitoring agent on the endpoint device, application telemetry data regarding the application;
• determining, by the service, that the application is evasive malware based on the identity of the application inferred from the traffic telemetry data and on the application telemetry data received from the monitoring agent on the endpoint device by:
• determining an identity of the application based on the application telemetry data received from the monitoring agent on the endpoint device, and
• comparing the identity of the application determined based on the application telemetry data with the identity of the application inferred from the traffic telemetry data;
• and
• initiating, by the service, performance of a mitigation action in the network, after determining that the application on the endpoint device is evasive malware.