Detection of malware and malicious applications

A system comprising:

• a network infrastructure device comprising a first memory unit and one or more first processors configured to perform instructions stored in the first memory unit;
• and
• a collector device comprising a second memory unit and one or more second processors configured to perform instructions stored in the second memory unit,
• wherein the network infrastructure device is configured to:
• receive an encrypted flow comprising a plurality of packets, the plurality of packets comprising a first set of packets and a second set of packets that is received after the first set of packets;
• identify a first datagram comprising the first set of packets and a second datagram comprising the second set of packets, the first datagram being associated with a first message and the second datagram being associated with a second message, wherein each packet of the first set of packets is received within a threshold amount of time of receipt of a preceding packet of the first set of packets, and wherein a first packet of the second set of packets is received after the threshold amount of time of receipt of a last packet of the first set of packets;
• determine a sequence of datagram lengths and times for the first datagram and the second datagram within the encrypted flow based on an arrival time of the first set of packets and the second set of packets;
• and
• send the sequence of datagram lengths and times to a collector device, and
• wherein the collector device is configured to:
• upon receiving the sequence of datagram lengths and times, determine whether an application is malicious based on the sequence of datagram lengths and times by determining an application identifier of the application;
• and
• upon determining that the application is malicious, send an alert signal to an administrator,
• wherein the alert signal indicates that a suspected malware or a threat has been detected, and the alert signal comprises at least one of a name, a type, a version of the application or information regarding the encrypted flow.

One or more non-transitory computer readable media comprising instructions which, when executed by one or more processors, cause:

• receiving, at a network infrastructure device, an encrypted flow comprising a plurality of packets, the plurality of packets comprising a first set of packets and a second set of packets that is received after the first set of packets;
• identifying, at the network infrastructure device, a first datagram comprising the first set of packets and a second datagram comprising the second set of packets, the first datagram being associated with a first message and the second datagram being associated with a second message, wherein each packet of the first set of packets is received within a threshold amount of time of receipt of a preceding packet of the first set of packets, and wherein a first packet of the second set of packets is received after the threshold amount of time of receipt of a last packet of the first set of packets;
• determining, at the network infrastructure device, a sequence of datagram lengths and times for the first datagram and the second datagram within the encrypted flow based on an arrival time of the first set of packets and the second set of packets;
• and
• sending, from the network infrastructure device, the sequence of datagram lengths and times to a collector device,
• wherein, upon receiving the sequence of datagram lengths and times, the collector device determines whether an application is malicious based on the sequence of datagram lengths and times by determining an application identifier of the application, and upon determining that the application is malicious, sends an alert signal to an administrator, and
• wherein the alert signal indicates that a suspected malware or a threat has been detected, and the alert signal comprises at least one of a name, a type, a version of the application or information regarding the encrypted flow.