Multi-View Fusion for Encrypted C2 Detection: A Leakage-Controlled Measurement Study of Evaluation Pitfalls
A leakage-controlled study of Cobalt Strike TLS flows finds fusion gains are tiny and evaluation pitfalls dwarf real detection effects.
Researchers tested whether fusing flow statistics and TLS handshake fingerprints improves encrypted command-and-control detection on 17,577 TLS flows from 62 real Cobalt Strike captures, using a leakage-controlled design. Computing frequency encodings on the full dataset rather than inside each cross-validation fold inflated F1 by 0.28, roughly ten times any measured fusion effect. Because labels and features depend on destination address, the flows form only 2,132 independent groups and the apparent 55.1% positive rate falls to 4.2%; 20 of 62 captures contain no TLS flows to known C2 addresses. Fusion beat the best single view by only 0.022 F1, and forging both feature surfaces made every model worse than an always-positive baseline (F1 0.711).
- Study used 17,577 TLS flows from 62 real Cobalt Strike captures.
- Full-dataset frequency encoding inflated F1 by 0.28, about ten times real effects.
- Flows collapse to 2,132 groups; the positive rate falls from 55.1% to 4.2%.
- Fusion beat the best single view by only 0.022 F1.
- Forging both feature surfaces made models lose to an always-positive baseline (F1 0.711).
Full article275 words · extracted from arxiv.org · click to collapse
Command-and-control (C2) traffic increasingly hides within TLS, so defenders now apply machine learning to traffic metadata. Many studies assume that combining two metadata views, namely flow statistics and TLS handshake fingerprints, improves both accuracy and robustness. We tested this assumption on 17,577 TLS flows from 62 real Cobalt Strike captures. Our evaluation removes the data leakage that leads to overly optimistic reported scores. We report three findings that matter more than the fusion result itself. First, an incorrect preprocessing step increases the F1 score by 0.28. This step computes the frequency encoding across the entire dataset rather than within each cross-validation fold. The increase is about ten times larger than any real effect we measured. Second, both the labels and the behavioral features depend on the destination address. Because of this, the 17,577 flows form only 2,132 independent groups, and the positive rate of 55.1\%, which looks balanced, drops to 4.2\%. Therefore, class balance is just a result of how we analyze the data, specifically whether we count flows or endpoints, and not a real feature of the task. Third, 20 of the 62 captures (32\%) have no TLS flows to any known C2 address, so they contain only benign samples. We checked these captures directly and confirmed that this is a gap in the ground truth, not a labeling error. In this context, fusion beats the best single view by only 0.022 in F1. When an attacker forges both feature surfaces simultaneously, every model performs worse than a simple baseline that always predicts positive (F1 = 0.711). For encrypted C2 detection, the evaluation design is not a preliminary step. It \emph{is} the main result.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.27311