Multiple pairwise feature histograms for representing network traffic

1. A method comprising:

dividing, by a device, groups of tuples of traffic characteristics of encrypted network traffic into a plurality of different pairs of the characteristics, each pair having a corresponding two- dimensional (2-D) feature subspace, wherein the encrypted network traffic is associated with a plurality of hosts in a network;

discretizing, by the device, the 2-D feature subspaces, to form a plurality of bins in each feature subspace, wherein each 2-D feature subspace is discretized with multiple grids of various characteristics, and the bins are of various sizes;

assigning, by the device, the pairs of the traffic characteristics in a particular group of tuples to the bins in the discretized 2-D feature subspaces;

forming, by the device and for each group of tuples, a vector representation of the group of tuples based on the bins in the discretized 2-D feature subspaces to which the pairs of the traffic characteristics from the group are assigned, wherein the vector representations of the groups of tuples are of a fixed dimension;

using, by the device, the vector representations of the groups of tuples to train a machine learning-based traffic classifier; and

assigning, by the device, hosts among the plurality of hosts associated with the encrypted network traffic that exhibit a similar network behavior to a behavioral cluster of hosts using the trained machine learning-based traffic classifier.

2. The method as in claim 1 , wherein the classifier is configured to detect malware by analyzing encrypted network traffic.

3. The method as in claim 1 , wherein the encrypted network traffic comprises Hypertext Transfer Protocol Secure (HTTPS) traffic.

4. The method as in claim 1 , wherein each tuple is a 4-tuple of traffic characteristics for an encrypted traffic flow comprising: downloaded bytes, uploaded bytes, connection duration, and inter-arrival time.

5. The method as in claim 1 , wherein discretizing the 2-D feature subspaces comprises:

performing, by the device, uniform discretization on the 2-D feature subspaces.

6. The method as in claim 1 , wherein discretizing the 2-D feature subspaces comprises:

performing, by the device, quantile discretization on the 2-D feature subspaces.

7. The method as in claim 1 , further comprising:

select, by the device, bins in the discretized 2-D subspaces for use in the vector representations by scoring each of the bins according to a measure of mutual independence between a given bin and a class label used by the classifier.

8. The method as in claim 1 , further comprising:

sending, by the device, the trained traffic classifier for deployment to a network.

9. An apparatus, comprising:

one or more network interfaces to communicate with a network;

a processor coupled to the network interfaces and configured to execute one or more processes; and

a memory configured to store a process executable by the processor, the process when executed configured to:

divide groups of tuples of traffic characteristics of encrypted network traffic into a plurality different pairs of the characteristics, each pair having a corresponding two- dimensional (2-D) feature subspace, wherein a plurality of hosts in a network are associated with the encrypted network traffic;

discretize the 2-D feature subspaces, to form a plurality of bins in each feature subspace, wherein each 2-D feature subspace is discretized with multiple grids of various characteristics, and the bins are of various sizes;

assign the pairs of the traffic characteristics in a particular group of tuples to the bins in the discretized 2-D feature subspaces;

form, for each group of tuples, a vector representation of the group of tuples based on the bins in the discretized 2-D feature subspaces to which the pairs of the traffic characteristics from the group are assigned, wherein the vector representations of the groups of tuples are of a fixed dimension;

use the vector representations of the groups of tuples to train a machine learning-traffic classifier; and

assign hosts among the plurality of hosts associated with the encrypted network traffic that exhibit a similar network behavior to a behavioral cluster of hosts using the trained machine learning-based traffic classifier.

10. The apparatus as in claim 9 , wherein the classifier is configured to detect malware by analyzing encrypted network traffic.

11. The apparatus as in claim 9 , wherein the fixed dimension is equal to a number of bins to which the pairs can be assigned.

12. The apparatus as in claim 9 , wherein each tuple is a 4-tuple of traffic characteristics for an encrypted traffic flow comprising: downloaded bytes, uploaded bytes, connection duration, and inter-arrival time.

13. The apparatus as in claim 9 , wherein the apparatus discretizes the 2-D feature subspaces by:

performing uniform discretization on the 2-D feature subspaces.

14. The apparatus as in claim 9 , wherein the apparatus discretizes the 2-D feature subspaces by:

performing quantile discretization on the 2 -D feature subspaces.

15. The apparatus as in claim 9 , wherein the process when executed is further configured to:

select bins in the discretized 2-D subspaces eligible for use in the vector representations by scoring each of the bins according to a measure of mutual independence between a given bin and a class label used by the classifier.

16. The apparatus as in claim 9 , wherein the process when executed is further configured to:

send the trained traffic classifier for deployment to a network.

17. A tangible, non-transitory, computer-readable medium storing program instructions that cause a device to execute a process comprising:

dividing, by the device, groups of tuples of traffic characteristics of encrypted network traffic into a plurality of different pairs of the characteristics, each pair having a corresponding two-dimensional (2-D) feature subspace, wherein a plurality of hosts in a network are associated with the encrypted network traffic;

discretizing, by the device, the 2-D feature subspaces, to form a plurality of bins in each feature subspace, wherein each 2-D feature subspace is discretized with multiple grids of various characteristics, and the bins are of various sizes;

assigning, by the device, the pairs of the traffic characteristics in a particular group of tuples to the bins in the discretized 2-D feature subspaces;

forming, by the device and for each group of tuples, a vector representation of the group of tuples based on the bins in the discretized 2-D feature subspaces to which the pairs of the traffic characteristics from the group are assigned, wherein the vector representations of the groups of tuples are of a fixed dimension;

using, by the device, the vector representations of the groups of tuples to train a machine learning-based traffic classifier; and

assigning, by the device, hosts among the plurality of hosts associated with the encrypted network traffic that exhibit a similar network behavior to a behavioral cluster of hosts using the trained machine learning-based traffic classifier.

18. The computer-readable medium as in claim 17 , wherein each tuple is a 4-tuple of traffic characteristics for an encrypted traffic flow comprising: downloaded bytes, uploaded bytes, connection duration, and inter-arrival time.