US 12,278,824 B2
Detecting malicious behavior from handshake protocols using machine learning
Dainius Ražinskas, Vilnius (LT); and Mantas Briliauskas, Vilnius (LT)
Assigned to UAB 360 IT, Vilnius (LT)
Filed by UAB 360 IT, Vilnius (LT)
Filed on Sep. 14, 2022, as Appl. No. 17/931,931.
Prior Publication US 2024/0089268 A1, Mar. 14, 2024
Int. Cl. H04L 9/40 (2022.01)
CPC H04L 63/1416 (2013.01) [H04L 63/1425 (2013.01)] 18 Claims
OG exemplary drawing
 
1. A method for predicting a malicious connection between a client device and a server, the method comprising:
before making a secure connection, obtaining handshake parameters for the client device and the server responsive to the client device initiating a connection with the server, wherein the handshake parameters comprise a first set of handshake parameters transmitted from the client device to the server in a client channel setup message and a second set of parameters transmitted from the server to the client device in a server channel setup message, and wherein the handshake parameters are unencrypted plaintext;
generating a feature set by extracting features from the handshake parameters, wherein extracting comprises evaluating non-numerical data from the first set of handshake parameters and the second set of handshake parameters;
predicting a maliciousness of the connection using a machine learning model, wherein the extracted features are provided as inputs to the machine learning model; and
automatically initiating a corrective action before making the secure connection if the connection is predicted to be malicious.