LATIDIA · Ciberseguridad

Fusión de múltiples vistas para la detección de C2 cifrado: un estudio de medición con control de fugas para identificar los escollos de la evaluación.

arXiv:2609.27311v1 Anuncio Tipo: nuevo Resumen: El tráfico de comando y control (C2) se oculta cada vez más dentro de TLS, por lo que los defensores ahora aplican aprendizaje automático a los metadatos del tráfico. Muchos estudios asumen que combinar dos metadatos

La noticia

arXiv:2609.27311v1 Announce Type: new Abstract: Command-and-control (C2) traffic increasingly hides within TLS, so defenders now apply machine learning to traffic metadata. Many studies assume that combining two metadata views, namely flow statistics and TLS handshake fingerprints, improves both accuracy and robustness. We tested this assumption on 17,577 TLS flows from 62 real Cobalt Strike captures. Our evaluation removes the data leakage that leads to overly optimistic reported scores. We report three findings that matter more than the fusion result itself. First, an incorrect preprocessing step increases the F1 score by 0.28. This step computes the frequency encoding across the entire dataset rather than within each cross-validation fold. The increase is