Malicious encrypted network traffic identification

A malicious encrypted traffic detector connected to a computer network, the detector comprising:

• a Shannon entropy estimator;
• an entropy comparator;
• and
• a store storing a reference measure of Shannon entropy of a portion of network traffic of a malicious encrypted network connection,
• wherein the estimator is adapted to estimate a measure of entropy for a corresponding portion of network traffic communicated over the computer network, and the entropy comparator is adapted to compare the estimated measure of entropy with the reference measure so as to determine if malicious encrypted network traffic is communicated over the network connection.

A method for identifying malicious encrypted network traffic communicated via a network between a first and second computer system, the method comprising:

• monitoring network traffic over the network to detect a network connection as a new network connection;
• identifying characteristics of the network connection to determine a protocol of the network connection;
• retrieving a definition of a portion of network traffic for a network connection based on the determined protocol;
• evaluating an estimated measure of entropy for a portion of network traffic of the new network connection based on the retrieved definition, wherein the measure of entropy is a measure of a degree of indeterminacy of information communicated via the new network connection;
• and
• comparing the estimated measure of entropy with a dictionary of one or more entropy measures, each of the one or more entropy measures being associated with a portion of network traffic of a malicious encrypted network connection, so as to determine if malicious encrypted network traffic is communicated over the network connection.

A malicious encrypted traffic detector connected to a computer network, the detector comprising:

• a monitor adapted to monitor network traffic over the network to detect a network connection as a new network connection;
• an analyzer adapted to identify characteristics of the network connection to determine a protocol of the network connection;
• a traffic portions definitions store adapted to store, for each of one or more network protocols, a definition of a portion of network traffic for a network connection;
• an entropy estimator adapted to evaluate an estimated measure of entropy for a portion of network traffic of a new network connection, the portion being identified from the traffic portions definitions store based on a protocol determined by the analyzer, wherein the measure of entropy is a measure of a degree of indeterminacy of information communicated via the new network connection;
• a dictionary data store storing a dictionary of one or more entropy measures, each of the one or more entropy measures being associated with a portion of network traffic of a malicious encrypted network connection;
• and
• an entropy comparator adapted to compare the estimated measure of entropy with at least one entropy measure in the dictionary so as to determine if malicious encrypted network traffic is communicated over the network connection.