Network telemetry with byte distribution and cryptographic protocol data elements

1. A method comprising:

at a device configured to operate in a network and including one or more processors and non-transitory memory:

receiving an encrypted flow including a plurality of bytes, each of the bytes having one of a plurality of byte values;

determining a byte value distribution metric based on a number of instances of each of the plurality of byte values in the encrypted flow, wherein the byte value distribution metric includes a probability distribution comprising a respective plurality of byte value probabilities corresponding to the plurality of byte values;

classifying, by a machine learning classifier, the encrypted flow as at least one of a benign flow, a malicious flow, a tunneled flow or a direct flow based on the byte value distribution metric; and

transmitting, via the network, telemetry data regarding the encrypted flow for receipt at a system in order to cause a remedial action to be performed at the system based on the telemetry data, the telemetry data including the byte value distribution metric and the classified encrypted flow.

2. The method of claim 1 , wherein the byte value probabilities are derived from a normalization of the number of instances of each of the plurality of byte values in the encrypted flow.

3. The method of claim 1 , wherein the byte value distribution metric includes a byte value entropy metric.

4. The method of claim 3 , wherein the byte value entropy metric includes Shannon's entropy of the probability distribution.

5. The method of claim 1 , wherein each one of the byte value probabilities are based on the number of instances of any of two or more of the plurality of byte values in the encrypted flow.

6. The method of claim 1 , wherein the encrypted flow includes a plurality of packets and each of the plurality of packets includes a subset of the plurality of bytes.

7. The method of claim 6 , wherein the telemetry data further includes at least one of a source IP address of the encrypted flow, a destination IP address of the encrypted flow, a start time of the encrypted flow, a stop time of the encrypted flow, a protocol associated with the encrypted flow, a number of the plurality of bytes, or a number of the plurality of packets.

8. The method of claim 1 , wherein the telemetry data further includes cryptographic protocol data.

9. The method of claim 8 , wherein the cryptographic protocol data includes at least one of a Transport Layer Security (TLS) version number, one or more ciphersuites offered by a source device, a ciphersuite selected by a destination device, a TLS sequence of record lengths and times, a record type, a handshake type, an extension type, a size of a cryptographic key, or one or more supported elliptical curves and supported point formats.

10. A system comprising:

a network interface configured to interface with a network;

one or more processors coupled to the network interface; and

a non-transitory memory comprising instructions that when executed cause the one or more processors to perform operations comprising:

receiving, via the network interface, an encrypted flow including a plurality of bytes, each of the bytes having one of a plurality of byte values;

determining from the encrypted flow a byte value distribution metric comprising an array of values, each array value being based on a number of instances of two or more byte values of a defined set of byte values associated with a respective element of the array, wherein the byte value distribution metric includes a probability distribution comprising a respective plurality of byte value probabilities corresponding to the plurality of byte values;

classifying, by a machine learning classifier, the encrypted flow as a benign flow, a malicious flow, a tunneled flow or a direct flow based on the byte value distribution metric; and

transmitting, via the network interface, telemetry data regarding the encrypted flow for receipt at a system in order to cause a remedial action to be performed at the system based on the telemetry data, the telemetry data including the byte value distribution metric and the classified encrypted flow.