Os start event detection, os fingerprinting, and device tracking using enhanced data features

An apparatus, comprising:

• one or more network interfaces to communicate with a network;
• a processor coupled to the network interfaces and configured to execute one or more processes;
• and
• a memory configured to store a process executable by the processor, the process when executed configured to:
• track changes in a source port or address identifier indicated by encrypted network traffic associated with a particular host in the network;
• detect an operating system of the particular host in the network based on the source port;
• detect an operating system restart event based on the track changes in the source port or address identifier indicated in the traffic data associated with the particular host;
• provide data regarding the operating system and the detected operating system start event as input to a machine learning-based malware detector;
• and
• cause performance of a mitigation action in the network when the malware detector determines that the particular host is infected with malware.

A tangible, non-transitory, computer-readable medium storing program instructions that cause a device to execute a process comprising:

• tracking, by the device, changes in a source port or address identifier indicated by encrypted network traffic associated with a particular host in a network;
• detecting, by the device, an operating system of the particular host in the network based on the source port;
• detecting, by the device, an operating system restart event based on the track changes in the source port or address identifier indicated in the traffic data associated with the particular host;
• providing, by the device, data regarding the operating system and the detected operating system start event as input to a machine learning-based malware detector;
• and
• causing, by the device, performance of a mitigation action in the network when the malware detector determines that the particular host is infected with malware.