# Feature Analysis of Encrypted Malicious Traffic

arXiv: https://arxiv.org/abs/2312.04596 · HTML: https://mlsanity.com/paper/2312.04596/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 3 of its 38 references that are in the map.
- First posted on arXiv 6 Dec 2023.

## Builds on (most cited first, 3 of 3)

- [XGBoost: A Scalable Tree Boosting System](https://mlsanity.com/paper/1603.02754/) (2016)
- [Deciphering Malware's use of TLS (without Decryption)](https://mlsanity.com/paper/1607.01639/) (2016)
- [Improving SIEM capabilities through an enhanced probe for encrypted Skype traffic detection](https://mlsanity.com/paper/1711.00524/) (2017)

## Abstract (arXiv)

In recent years there has been a dramatic increase in the number of malware attacks that use encrypted HTTP traffic for self-propagation or communication. Antivirus software and firewalls typically will not have access to encryption keys, and therefore direct detection of malicious encrypted data is unlikely to succeed. However, previous work has shown that traffic analysis can provide indications of malicious intent, even in cases where the underlying data remains encrypted. In this paper, we apply three machine learning techniques to the problem of distinguishing malicious encrypted HTTP traffic from benign encrypted traffic and obtain results comparable to previous work. We then consider the problem of feature analysis in some detail. Previous work has often relied on human expertise to determine the most useful and informative features in this problem domain. We demonstrate that such feature-related information can be obtained directly from machine learning models themselves. We argue that such a machine learning based approach to feature analysis is preferable, as it is more reliable, and we can, for example, uncover relatively unintuitive interactions between features.