Can malware be detected from flow statistics alone?

Often, yes, because malware has to behave in certain ways to be useful, and that behaviour shows in the flows. Flow records describe each connection: source and destination, ports, start time, duration, and bytes and packets in each direction. A compromised device that checks in with its controller at regular intervals produces a recognisable rhythm, called beaconing; one that explores the network touches many internal hosts and ports in a short time, which is scanning and lateral movement; one that steals data sends far more than it normally does, often at night. None of this needs decryption, and research on encrypted traffic analysis has shown for years that timing and size patterns carry a lot of information. The limits: a single connection to a well-known cloud service can look innocent, and patient attackers try to blend in. That is why flow analysis works best against a baseline of what is normal for each device. NetSenX detects beaconing, scanning, lateral movement and unusual outbound volume on every plan, Free included.

← All 40 questions on Encryption and encrypted trafficAll topics