# US 11,909,760 B2 · Malware classification and attribution through server fingerprinting using server certificate data > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,909,760 B2 - Document ID: US11909760B2 - Status: Granted - Kind: B2 - Application number: 17/395,968 - Filed: 2021-08-06 - Published: 2021-12-02 - Granted: 2024-02-20 - Earliest claimed: 2016-11-16 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Blake Harrell Anderson; David McGrew; Subharthi Paul; Ivan Nikolaev; Martin Grill - Web page: https://patentgrep.com/patent/US11909760B2 ## CPC - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - G06N 20/00: Machine learning - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract In one embodiment, a device in a network receives certificate data for an encrypted traffic flow associated with a client node in the network. The device determines one or more data features from the certificate data. The device determines one or more flow characteristics of the encrypted traffic flow. The device performs a classification of an application executed by the client node and associated with the encrypted traffic flow by using a machine learning-based classifier to assess the one or more data features from the certificate data and the one or more flow characteristics of the traffic flow. The device causes performance of a network action based on a result of the classification of the application. ## Claims ### Claim 1 A method comprising: obtaining, by a device in a network, certificate data of a presently encrypted traffic flow sent from a client node in the network to a remote server, wherein the certificate data of the encrypted traffic flow is passively intercepted by an intermediary device between the client node and the remote server without a man-in-the-middle; determining, by the device, one or more data features from the certificate data of the encrypted traffic flow; determining, by the device, one or more flow characteristics of the encrypted traffic flow; performing, by the device, a classification of an application executed by the client node and associated with the encrypted traffic flow by using a machine learning-based classifier to assess the one or more data features from the certificate data of the encrypted traffic flow and the one or more flow characteristics of the encrypted traffic flow, wherein the machine learning-based classifier assesses the certificate data of the encrypted traffic flow without decrypting the encrypted traffic flow; and causing, by the device, performance of a network action based on a result of the classification of the application. ### Claim 2 (depends on 1) The method as in claim 1, wherein the classification indicates that the application is malware. ### Claim 3 (depends on 1) The method as in claim 1, wherein the network action comprises at least one of: blocking the encrypted traffic flow or sending a notification in the network regarding the classification. ### Claim 4 (depends on 1) The method as in claim 1, wherein the one or more flow characteristics comprise one or more of: sequence of packet lengths and time (SPLT) data regarding the encrypted traffic flow, sequence of application lengths and time (SALT) data regarding the encrypted traffic flow, byte distribution (BD) data regarding the encrypted traffic flow, a ciphersuite, or a Transport Layer Security (TLS) extension. ### Claim 5 (depends on 1) The method as in claim 1, wherein the one or more data features from the certificate data comprise one or more of: a subjectAltName entry, a certificate validity time period, or a subject common name identifier. ### Claim 6 (depends on 1) The method as in claim 1, wherein the machine learning-based classifier is configured to assess one or more of: a length of a subject common name identifier, a character frequency of the subject common name identifier, a certificate validity time period, or a number of subjectAltName entries. ### Claim 7 (depends on 1) The method as in claim 1, further comprising: performing, by the device, the classification of the application based in part on an assessment of the one or more data features from the certificate data by a rule-based analyzer. ### Claim 8 (depends on 1) The method as in claim 1, further comprising: using, by the device, a training set of one or more data features of a plurality of certificates to train the machine learning-based classifier. ### Claim 9 (depends on 1) The method as in claim 1, wherein obtaining the certificate data of the encrypted traffic flow comprises: receiving, by the device, the certificate data of the encrypted traffic flow from the intermediary device that passively intercepts the certificate data of the encrypted traffic flow. ### Claim 10 An apparatus, comprising: one or more network interfaces to communicate with a network; a processor coupled to the one or more network interfaces and configured to execute one or more processes; and a memory configured to store a process that is executable by the processor, the process when executed operable to: obtain certificate data of a presently encrypted traffic flow sent from a client node in the network to a remote server, wherein the certificate data of the encrypted traffic flow is passively intercepted by an intermediary device between the client node and the remote server without a man-in-the-middle; determine one or more data features from the certificate data of the encrypted traffic flow; determine one or more flow characteristics of the encrypted traffic flow; perform a classification of an application executed by the client node and associated with the encrypted traffic flow by using a machine learning-based classifier to assess the one or more data features from the certificate data of the encrypted traffic flow and the one or more flow characteristics of the encrypted traffic flow, wherein the machine learning-based classifier assesses the certificate data of the encrypted traffic flow without decrypting the encrypted traffic flow; and cause performance of a network action based on a result of the classification of the application. ### Claim 11 (depends on 10) The apparatus as in claim 10, wherein the classification indicates that the application is malware. ### Claim 12 (depends on 10) The apparatus as in claim 10, wherein the network action comprises at least one of: blocking the encrypted traffic flow or sending a notification in the network regarding the classification. ### Claim 13 (depends on 10) The apparatus as in claim 10, wherein the one or more flow characteristics comprise one or more of: sequence of packet lengths and time (SPLT) data regarding the encrypted traffic flow, sequence of application lengths and time (SALT) data regarding the encrypted traffic flow, byte distribution (BD) data regarding the encrypted traffic flow, a ciphersuite, or a Transport Layer Security (TLS) extension. ### Claim 14 (depends on 10) The apparatus as in claim 10, wherein the one or more data features from the certificate data comprise one or more of: a subjectAltNarne entry, a certificate validity time period, or a subject common name identifier. ### Claim 15 (depends on 10) The apparatus as in claim 10, wherein the machine learning-based classifier is configured to assess one or more of: a length of a subject common name identifier, a character frequency of the subject common name identifier, a certificate validity time period, or a number of subjectAltName entries. ### Claim 16 (depends on 10) The apparatus as in claim 10, wherein the process when executed is further operable to: perform the classification of the application based in part on an assessment of the one or more data features from the certificate data by a rule-based analyzer. ### Claim 17 (depends on 10) The apparatus as in claim 10, wherein the process when executed is further operable to: use a training set of one or more data features of a plurality of certificates to train the machine learning-based classifier. ### Claim 18 (depends on 10) The apparatus as in claim 10, wherein the apparatus obtains the certificate data of the encrypted traffic flow by receiving the certificate data of the encrypted traffic flow from the intermediary device that passively intercepts the certificate data of the encrypted traffic flow. ### Claim 19 A tangible, non-transitory, computer-readable medium that stores program instructions that cause a device in a network to execute a process comprising: obtaining, by the device, certificate data of a presently encrypted traffic flow sent from a client node in the network to a remote server, wherein the certificate data of the encrypted traffic flow is passively intercepted by an intermediary device between the client node and the remote server without a man-in-the-middle; determining, by the device, one or more data features from the certificate data of the encrypted traffic flow; determining, by the device, one or more flow characteristics of the encrypted traffic flow; performing, by the device, a classification of an application executed by the client node and associated with the encrypted traffic flow by using a machine learning-based classifier to assess the one or more data features from the certificate data of the encrypted traffic flow and the one or more flow characteristics of the encrypted traffic flow, wherein the machine learning-based classifier assesses the certificate data of the encrypted traffic flow without decrypting the encrypted traffic flow; and causing, by the device, performance of a network action based on a result of the classification of the application. ### Claim 20 (depends on 19) The tangible, non-transitory, computer-readable medium as in claim 19, wherein: the one or more data features from the certificate data comprises one or more of: a subjectAltName entry, a certificate validity time period, or a subject common name identifier, and the one or more flow characteristics comprise one or more of: sequence of packet lengths and time (SPLT) data regarding the encrypted traffic flow, sequence of application lengths and time (SALT) data regarding the encrypted traffic flow, byte distribution (BD) data regarding the encrypted traffic flow, a ciphersuite, or a Transport Layer Security (TLS) extension.