Passive decryption on encrypted traffic to generate more accurate machine learning training data

Patent metadata

Field	Value
Publication number	US-10536268-B2
Application number	US-201715692288-A
Country	US
Kind code	B2
Filing date	Aug 31, 2017
Priority date	Aug 31, 2017
Publication date	Jan 14, 2020
Grant date	Jan 14, 2020

Abstract

In one embodiment, an apparatus captures a memory dump of a device in a sandbox environment executing a malware sample. The apparatus identifies a cryptographic key based on a particular data structure in the captured memory dump. The apparatus uses the identified cryptographic key to decrypt encrypted traffic sent by the device. The apparatus labels at least a portion of the decrypted traffic sent by the device as benign. The apparatus trains a machine learning-based traffic classifier based on the at least a portion of the decrypted traffic sent by the device and labeled as benign.

First claim

What is claimed is:

1. A method comprising:
detecting a triggering condition to initiate a memory dump a device in a sandbox environment executing a malware sample, wherein the trigger condition includes at least a time interval expiration based on one or more prior executions of the malware sample in the sandbox environment;
identifying a cryptographic key based on a particular data structure in the memory dump;
using the identified cryptographic key to decrypt encrypted traffic sent by the device;
labeling at least a portion of the decrypted traffic sent by the device as benign; and
training a machine learning-based traffic classifier based on the at least a portion of the decrypted traffic sent by the device and labeled as benign.

2. The method as in claim 1 , further comprising:
deploying the machine learning-based traffic classifier to a node in a network, to detect the presence of malware in the network.

3. The method as in claim 1 , wherein the particular data structure comprises a wrapper for the cryptographic key, the method further comprising:
identifying a particular encryption suite used by the device to encrypt the traffic; and
identifying the data structure based on the identified encryption suite used by the device to encrypt the traffic.

4. The method as in claim 1 , wherein the triggering condition to initiate the memory dump further comprises one of: a Change Cipher Spec message appearing in the traffic of the device, multiple socket.send( ) calls to a particular 5-tuple being observed, detecting multiple calls to a particular application programming interface (API) of the device.

5. The method as in claim 1 , wherein identifying the encryption key based on the particular data structure in the memory dump comprises:
identifying a set of bytes in the memory dump having high entropy in comparison to bytes preceding or following the set of bytes in the memory dump.

6. The method as in claim 1 , wherein the traffic sent by the device is encrypted using Transport Layer Security (TLS).

7. An apparatus, comprising:
one or more network interfaces to communicate with a network;
a processor coupled to the network interfaces and configured to execute one or more processes; and
a memory configured to store a process executable by the processor, the process when executed configured to:
detect a triggering condition to initiate a memory dump a device in a sandbox environment executing a malware sample, wherein the trigger condition includes at least a time interval expiration based on one or more prior executions of the malware sample in the sandbox environment;
identify a cryptographic key based on a particular data structure in the memory dump;
use the identified cryptographic key to decrypt encrypted traffic sent by the device;
label at least a portion of the decrypted traffic sent by the device as benign; and
train a machine learning-based traffic classifier based on the at least a portion of the decrypted traffic sent by the device and labeled as benign.

8. The apparatus as in claim 7 , wherein the process when executed is further configured to:
deploy the machine learning-based traffic classifier to a node in a network, to detect the presence of malware in the network.

9. The apparatus as in claim 7 , wherein the particular data structure comprises a wrapper for the cryptographic key, wherein the process when executed is further configured to:
identify a particular encryption suite used by the device to encrypt the traffic; and
identify the data structure based on the identified encryption suite used by the device to encrypt the traffic.

10. The apparatus as in claim 7 , wherein the triggering condition to initiate the memory dump further comprises one of: a Change Cipher Spec message appearing in the traffic of the device, multiple socket.send( ) calls to a particular 5-tuple being observed, detecting multiple calls to a particular application programming interface (API) of the device.

11. The apparatus as in claim 7 , wherein the apparatus identifies the encryption key based on the particular data structure in the memory dump by:
identifying a set of bytes in the memory dump having high entropy in comparison to bytes preceding or following the set of bytes in the memory dump.

12. The apparatus as in claim 7 , wherein the traffic sent by the device is encrypted using Transport Layer Security (TLS).

13. A tangible, non-transitory, computer-readable medium storing program instructions that cause a computing device to execute a process comprising:
detecting a triggering condition to initiate a memory dump a device in a sandbox environment executing a malware sample, wherein the trigger condition includes at least a time interval expiration based on one or more prior executions of the malware sample in the sandbox environment;
identifying a cryptographic key based on a particular data structure in the captured memory dump;
using the identified cryptographic key to decrypt encrypted traffic sent by the device;
labeling at least a portion of the decrypted traffic sent by the device in the sandbox environment as benign; and
training a machine learning-based traffic classifier based on the at least a portion of the decrypted traffic sent by the device in the sandbox environment and labeled as benign.

14. The computer-readable medium as in claim 13 , wherein the triggering condition to initiate the memory dump further comprises one of: a Change Cipher Spec message appearing in the traffic of the device, multiple socket.send( ) calls to a particular 5-tuple being observed, detecting multiple calls to a particular application programming interface (API) of the device.

15. The computer-readable medium as in claim 13 , wherein the particular data structure comprises a wrapper for the cryptographic key, wherein the process when executed further comprises:
identifying a particular encryption suite used by the device to encrypt the traffic; and
identifying the data structure based on the identified encryption suite used by the device to encrypt the traffic.

16. The computer-readable medium as in claim 13 , wherein the process identifies the encryption key based on the particular data structure in the memory dump by:
identifying a set of bytes in the memory dump having high entropy in comparison to bytes preceding or following the set of bytes in the memory dump.

17. The computer-readable medium as in claim 13 , wherein the traffic sent by the device is encrypted using Transport Layer Security (TLS).

18. The computer-readable medium as in claim 13 , wherein the process when executed is further comprises:
deploying the machine learning-based traffic classifier to a node in a network, to detect the presence of malware in the network.

Assignees

• Cisco Tech Inc

Inventors

• Anderson Blake Harrell
• Chi Andrew
• Mcgrew David
• Dunlop Scott William

Classifications

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L9/0894 Primary

  Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage · CPC title

• H04W72/27

  between access points · CPC title