Machine Learning Based Encrypted Command and Control Traffic Classification

Abstract

As cyber-attacks evolve and the use of encrypted command and control (C2) channels grows, it presents a real challenge for modern network security. The classifiers that are currently available for detecting malicious traffic in encrypted traffic streams are not sufficiently effective, and require more sophisticated methods to reliably classify this traffic. The study examines the use of machine learning methods for identifying encrypted C2 traffic, enabling proactively fighting the new cyberattacks. The proposed framework uses supervised and unsupervised learning models to analyze statistical and behavioral information of the network traffic flows without the need for decryption to maintain privacy and efficiency. The adaptation of lightweight algorithms enables scalability and energy efficiency, aligning with sustainable software engineering practices. This will not only improve the cybersecurity resilience but also help create sustainable computing environments, help reduce downtime, help prevent misuse of resources, and helps protect critical infrastructure including smart grids, IoT systems, and data centers. The results underline the dual nature of machine learning, both in terms of network security and sustainable, resilient digital ecosystems.