Machine-learning association of application-specific flows within encrypted QUIC traffic

1 . A method comprising:

obtaining, at a device, one or more packets of an encrypted QUIC traffic session in a network;

determining, by the device, a plurality of application-specific flows multiplexed within the encrypted QUIC traffic session using a flexible fingerprint definition applied to extract a fingerprint for a particular packet that matches a filter;

querying, by the device, a fingerprint database that maintains database entries listing processes and their destinations that have been previously observed using the fingerprint across multiple protocols;

associating a plurality of packets within the encrypted QUIC traffic session with a first application-specific flow of the plurality of application-specific flows by applying a machine learning classifier to one or more packets from the encrypted QUIC traffic session, wherein the machine learning classifier is configured to identify a most probable client process that initiated the encrypted QUIC traffic session based on the fingerprint and destination context information; and

determining, by the device, that the most probable client process comprises one of malware or a security vulnerability requiring updating or removal from an endpoint.

2 . The method of claim 1 , wherein the machine learning classifier comprises one or more of: k-nearest neighbors (k-NN), statistical techniques, neural networks, and Markov models.

3 . The method of claim 1 , wherein associating the plurality of packets comprises determining that the first application-specific flow corresponds to one of a video streaming flow, a web browsing flow, or a malicious flow.

4 . The method of claim 1 , wherein the machine learning classifier analyzes one or more of: sequence of packet lengths and time (SPLT) data, sequence of application lengths and time (SALT) data, or byte distribution (BD) data.

5 . The method as in claim 1 , further comprising:

enhancing, by the device, the classifier with a host model.

6 . The method as in claim 5 , wherein the host model is associated with a host device of the network that sent the one or more packets.

7 . A system comprising:

one or more computers each including a processor and a memory, wherein the one or more computers are operable to execute instructions which cause the system to perform operations including:

obtaining, at a device, one or more packets of an encrypted QUIC traffic session in a network;

determining, by the device, a plurality of application-specific flows multiplexed within the encrypted QUIC traffic session using a flexible fingerprint definition applied to extract a fingerprint for a particular packet that matches a filter;

querying, by the device, a fingerprint database that maintains database entries listing processes and their destinations that have been previously observed using the fingerprint across multiple protocols;

associating a plurality of packets within the encrypted QUIC traffic session with a first application-specific flow of the plurality of application-specific flows by applying a machine learning classifier to one or more packets from the encrypted QUIC traffic session, wherein the machine learning classifier is configured to identify a most probable client process that initiated the encrypted QUIC traffic session based on the fingerprint and destination context information; and

determining, by the device, that the most probable client process comprises one of malware or a security vulnerability requiring updating or removal from an endpoint.

8 . The system of claim 7 , wherein the machine learning classifier comprises one or more of: k-nearest neighbors (k-NN), decision trees, convolutional neural networks (CNN), recurrent neural networks (RNN), and long short-term memory (LSTM) networks.

9 . The system of claim 7 , wherein associating the plurality of packets comprises determining that the first application-specific flow corresponds to one of a video streaming flow, a web browsing flow, or malware flow.

10 . The system of claim 7 , wherein the machine learning classifier analyzes one or more of: sequence of packet lengths and time (SPLT) data, sequence of application lengths and time (SALT) data, or byte distribution (BD) data.

11 . The system of claim 7 , further comprising: enhancing, by the device, the classifier with a host model.

12 . The system of claim 11 , wherein the host model is associated with a host device of the network that sent the one or more packets.

13 . A non-transitory computer-readable medium including instructions, which when executed on one or more computers each including a processor and a memory, cause the computers to perform operations including:

obtaining, at a device, one or more packets of an encrypted QUIC traffic session in a network;

determining, by the device, a plurality of application-specific flows multiplexed within the encrypted QUIC traffic session using a flexible fingerprint definition applied to extract a fingerprint for a particular packet that matches a filter;

querying, by the device, a fingerprint database that maintains database entries listing processes and their destinations that have been previously observed using the fingerprint across multiple protocols;

associating a plurality of packets within the encrypted QUIC traffic session with a first application-specific flow of the plurality of application-specific flows by applying a machine learning classifier to one or more packets from the encrypted QUIC traffic session, wherein the machine learning classifier is configured to identify a most probable client process that initiated the encrypted QUIC traffic session based on the fingerprint and destination context information; and

determining, by the device, that the most probable client process comprises one of malware or a security vulnerability requiring updating or removal from an endpoint.

14 . The non-transitory computer-readable medium of claim 13 , wherein the machine learning classifier comprises one or more of: k-nearest neighbors (k-NN), decision trees, convolutional neural networks (CNN), recurrent neural networks (RNN), and long short-term memory (LSTM) networks.

15 . The non-transitory computer-readable medium of claim 13 , wherein associating the plurality of packets comprises determining that the first application-specific flow corresponds to one of a video streaming flow, a web browsing flow, or malware flow.

16 . The non-transitory computer-readable medium of claim 13 , wherein the machine learning classifier analyzes one or more of: sequence of packet lengths and time (SPLT) data, sequence of application lengths and time (SALT) data, or byte distribution (BD) data.

17 . The non-transitory computer-readable medium of claim 13 , further comprising: enhancing, by the device, the classifier with a host model.

18 . The non-transitory computer-readable medium of claim 17 , wherein the host model is associated with a host device of the network that sent the one or more packets.