US 11,909,760 B2
Malware classification and attribution through server fingerprinting using server certificate data
Blake Harrell Anderson, Chapel Hill, NC (US); David McGrew, Poolesville, MD (US); Subharthi Paul, San Jose, CA (US); Ivan Nikolaev, Prague (CZ); and Martin Grill, Prague (CZ)
Assigned to CISCO TECHNOLOGY, INC., San Jose, CA (US)
Filed by Cisco Technology, Inc., San Jose, CA (US)
Filed on Aug. 6, 2021, as Appl. No. 17/395,968.
Application 17/395,968 is a continuation of application No. 16/869,726, filed on May 8, 2020, granted, now 11,108,810.
Application 16/869,726 is a continuation of application No. 15/353,160, filed on Nov. 16, 2016, granted, now 10,686,831, issued on Jun. 16, 2020.
Prior Publication US 2021/0377283 A1, Dec. 2, 2021
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 29/06 (2006.01); H04L 9/40 (2022.01); G06N 20/00 (2019.01)
CPC H04L 63/145 (2013.01) [H04L 63/0428 (2013.01); H04L 63/1408 (2013.01); G06N 20/00 (2019.01)] 20 Claims
OG exemplary drawing
 
1. A method comprising:
obtaining, by a device in a network, certificate data of a presently encrypted traffic flow sent from a client node in the network to a remote server, wherein the certificate data of the encrypted traffic flow is passively intercepted by an intermediary device between the client node and the remote server without a man-in-the-middle;
determining, by the device, one or more data features from the certificate data of the encrypted traffic flow;
determining, by the device, one or more flow characteristics of the encrypted traffic flow;
performing, by the device, a classification of an application executed by the client node and associated with the encrypted traffic flow by using a machine learning-based classifier to assess the one or more data features from the certificate data of the encrypted traffic flow and the one or more flow characteristics of the encrypted traffic flow, wherein the machine learning-based classifier assesses the certificate data of the encrypted traffic flow without decrypting the encrypted traffic flow; and
causing, by the device, performance of a network action based on a result of the classification of the application.