Multi-View Fusion for Encrypted C2 Detection: A Leakage-Controlled Measurement Study of Evaluation Pitfalls
A leakage-controlled study of Cobalt Strike TLS flows finds fusion gains are tiny and evaluation pitfalls dwarf real detection effects.
Researchers tested whether fusing flow statistics and TLS handshake fingerprints improves encrypted command-and-control detection on 17,577 TLS flows from 62 real Cobalt Strike captures, using a leakage-controlled design. Computing frequency encodings on the full dataset rather than inside each cross-validation fold inflated F1 by 0.28, roughly ten times any measured fusion effect. Because labels and features depend on destination address, the flows form only 2,132 independent groups and the apparent 55.1% positive rate falls to 4.2%; 20 of 62 captures contain no TLS flows to known C2 addresses. Fusion beat the best single view by only 0.022 F1, and forging both feature surfaces made every model worse than an always-positive baseline (F1 0.711).
- Study used 17,577 TLS flows from 62 real Cobalt Strike captures.
- Full-dataset frequency encoding inflated F1 by 0.28, about ten times real effects.
- Flows collapse to 2,132 groups; the positive rate falls from 55.1% to 4.2%.
- Fusion beat the best single view by only 0.022 F1.
- Forging both feature surfaces made models lose to an always-positive baseline (F1 0.711).
- Products
- Cobalt Strike
- Malware
- Cobalt Strike
From the original article
1 min read at arxiv.orgCommand-and-control (C2) traffic increasingly hides within TLS, so defenders now apply machine learning to traffic metadata. Many studies assume that combining two metadata views, namely flow statistics and TLS handshake fingerprints, improves both accuracy and robustness. We tested this assumption on 17,577 TLS flows from 62 real Cobalt Strike captures.
By Hoang-Huy Nguyen-Huu · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.