Network telemetry with byte distribution and cryptographic protocol data elements

An apparatus, comprising:

• one or more network interfaces;
• a processor coupled to the one or more network interfaces;
• and
• a memory configured to store one or more instructions, that when executed by the processor, configure the processor to:
• receive, via a computer network, telemetry data of a traffic flow including a plurality of packets encrypted using a cryptographic protocol, the telemetry data including cryptographic protocol data that is unencrypted;
• identify multiple Transport Layer Security (TLS) features of the cryptographic protocol data, the multiple TLS features including two or more of;
• a TLS version number, one or more ciphersuites offered by a source device, a ciphersuite selected by a destination device, a TLS sequence of record lengths and times, a record type, a handshake type, an extension type, a size of a cryptographic key, a supported elliptical curve, or a supported point format;
• perform, without decrypting individual ones of the plurality of packets, an analysis on the multiple TLS features using a machine learning model that has been trained with previously classified traffic data;
• classify a TLS implementation of the traffic flow based on the analysis, the TLS implementation being indicative of a cryptographic library implemented in communicating the traffic flow;
• and
• take a remedial action with respect to the traffic flow based on the classifying of the TLS implementation of the traffic flow.

A tangible, non-transitory, computer-readable medium that stores program instructions causing a gateway label edge router to execute a process comprising:

• receiving, via a computer network, telemetry data of a traffic flow including a plurality of packets encrypted using a cryptographic protocol, the telemetry data of the traffic flow including cryptographic protocol data that is unencrypted;
• identifying multiple Transport Layer Security (TLS) features of the cryptographic protocol data, the multiple TLS features including two or more of:
• a TLS version number, one or more ciphersuites offered by a source device, a ciphersuite selected by a destination device, a TLS sequence of record lengths and times, a record type, a handshake type, an extension type, a size of a cryptographic key, a supported elliptical curve, or a supported point format;
• performing, without decrypting individual ones of the plurality of packets, an analysis on the multiple TLS features using a machine learning model that has been trained with previously classified traffic data;
• classifying a TLS implementation of the traffic flow based on the analysis, the TLS implementation being indicative of a cryptographic library implemented in communicating the traffic flow;
• and
• taking a remedial action with respect to the traffic flow based on the classifying of the TLS implementation of the traffic flow.