System and method for intrusion detection of malware traffic based on feature information

A system-on-a-chip (SoC) comprising:

• a deep packet inspection (DPI) engine;
• at least one processor core, the at least one processor core of the SoC configured to implement a traffic scanner configured to produce feature information associated with non-payload content of encrypted packets in a received traffic stream that cannot be decrypted by the SoC;
• and
• a machine learning (ML) engine, the traffic scanner of the SoC further configured to provide the feature information produced to the ML engine of the SoC and to employ the DPI engine of the SoC to compute at least a portion of the feature information associated with the non-payload content of encrypted packets in the received traffic stream that cannot be decrypted by the SoC due to missing security associated information in the received traffic stream enabling decryption at the SoC,
• the ML engine of the SoC implemented in hardware and configured to (i) assign a classification to the received traffic stream based on the feature information produced and (ii) based on the classification assigned, provide notification to the traffic scanner that malware traffic has been detected in the traffic stream,
• the traffic scanner further configured to perform, based on the notification provided, an action toward preventing malicious activity otherwise caused by malware traffic.