Offloading Encrypted C2 Traffic Mitigation to SmartNICs

As command and control (C2) traffic increasingly adopts the Transport Layer Security (TLS) protocol, traditional detection methods relying on deep packet inspection (DPI) become ineffective. Machine learning (ML) classifiers offer a promising alternative by identifying encrypted C2 traffic without inspecting payloads. At the same time, modern smart network interface cards (smartNICs) provide advanced processing capabilities, allowing security applications to run directly on the hardware. This paper leverages smartNICs to implement an ML classifier for encrypted C2 detection. Data plane development kit (DPDK) is used to program the smartNIC and implement a random forest (RF) model. The system achieves 99.9% accuracy on publicly available datasets while sustaining a 50Gbps throughput with minimal processing overhead.