1

I was working on a little research project to correctly identify the encrypted traffic pattern generated by various tools/applications for example metasploit (or increase the success rate). I have run a few exploits using metasploit in some VMs and found the encrypted traffic. The traffic will be used as training data for supervised machine learning algorithms.

Now I want a bunch of captures. I wanted to know if there exists such a database where I can find encrypted traffic that is generated by some hacking tools.

Also, I am interested in knowing as many tools as possible that generates encrypted malicious traffic.

  • 3
    You are hoping to identify malicious traffic by the signature of the encrypted transmission? I'm not sure that will work ... When the data changes, how will you differentiate between malicious data and benign data? – schroeder Mar 9 '16 at 19:29
  • 1
    No, the idea is to use these data sets to generate traffic patterns, based on average packet sizes, max size, min size, inter packet arrival times, number of packets in a session to classify which tools/applications the traffic is possibly coming from. – imrn Mar 9 '16 at 19:36
  • 2
    I doubt that such a database exists. It would be impossible to maintain. The current trend in machine learning to detect malicious traffic is to look for anomalies and new traffic patterns, and not to try to identify malicious traffic by common metadata. – schroeder Mar 9 '16 at 20:04
  • 2
    Metasploit, for instance, is a collection of a wide range of communication. Different payloads, even custom ones, will have their own pattern. – schroeder Mar 9 '16 at 20:05
  • 1
    I think @schroeder's point is very valid. Maintaining a database of known tools will be next to impossible and you only have to change the tool slightly to not match. However, a system which learns about 'normal' traffic and then identifies abnormal is likely to be more resilient. I also wonder how reliable the metadata you plan to use will prove to be - a lot is done with encryption of data to minimise such patterns as they are a source often used to try and reverse engineer encryption. – Tim X Mar 11 '16 at 3:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.