An Analysis of TLS Parameter Variation in Malware C2 Communication

Transport Layer Security (TLS), previously known as Secure Sockets Layer (SSL), is a common protocol for encrypted communication. Since TLS has now become popular and many applications communicate over TLS, attackers have started to choose to hide their activities inside TLS communications. One of the countermeasures to detect malicious TLS communication is TLS fingerprinting. In this paper, we focused on the probability that the TLS parameters used in TLS client fingerprinting may have variations that have not been taken into account in the previous work. Through the analysis of approximately 11.5 years of malware communication datasets, we have clarified the transition of TLS parameters, especially the changes before and after the spread of TLS 1.3. We also introduce two new concepts of parameter variation: Parameter Fluctuation and Parameter Drift. We revealed through detailed investigations of three malware families, Trickbot, IcedID, and Cobalt Strike, that these parameter variations do indeed occur in real-world malware C2 communications. Finally, to provide suggestions for the design of fluctuation-tolerant TLS fingerprints, we deeply discussed the nature of parameter fluctuations and provided directions for future work based on preliminary experiments.