Extracting Encryption Metadata and Terminating Malicious Connections Using Machine Learning

A method for detecting malicious behavior based on network communications establishing an encrypted connection between a smart appliance and a remote server, comprising:

• intercepting, by a network traffic hub in a local network, a first network communication from a smart appliance in the local network, for transmission to a remote server in a wide area network, the first network communication comprising an encryption suite that comprises one or more encryption algorithms the smart appliance uses to encrypt network traffic with the remote server;
• extracting the encryption suite from the first network communication;
• transmitting, by the network traffic hub, the first network communication to the remote server;
• intercepting, by the network traffic hub, one or more second network communications from the remote server to the smart appliance, the one or more second network communications comprising a public certificate associated with the remote server and an identified subset of the one or more encryption algorithms;
• extracting the public certificate and the identified subset of the one or more encryption algorithms from the one or more second network communications;
• transmitting, by the network traffic hub, the one or more second network communications to the smart appliance;
• detecting malicious behavior performed by the smart appliance or remote server, based on the encryption suite, public certificate, and the identified subset of the one or more encryption algorithms;
• and
• blocking network communications between the smart appliance and the remote server, responsive to detecting malicious behavior in the network communications between the smart appliance and the remote server by the network traffic hub.

A non-transitory computer-readable medium comprising stored program code, the program code comprised of computer-executable instructions that, when executed by a processor, causes the processor to:

• intercept, via a first communication channel in a local network, a first network communication from a smart appliance for transmission, via a second communication channel in a wide area network, to a remote server, the first network communication comprising an encryption suite that comprises one or more encryption algorithms the smart appliance uses to encrypt network traffic with the remote server;
• extract the encryption suite from the first network communication;
• transmit, via the second communication channel, the first network communication to the remote server;
• intercept, via the second communication channel, one or more second network communications from the remote server to the smart appliance, the one or more second network communications comprising a public certificate associated with the remote server and an identified subset of the one or more encryption algorithms;
• extract the public certificate and the identified subset of the one or more encryption algorithms from the one or more second network communications;
• transmit, via the first communication channel, the one or more second network communications to the smart appliance;
• detect malicious behavior performed by the smart appliance or remote server, via the first and second communication channels, based on the encryption suite, public certificate, and the identified subset of the one or more encryption algorithms;
• and
• block network communications between the smart appliance and the remote server, in response to detecting malicious behavior in the network communications between the smart appliance and the remote server.