Post #2872960

2026-05-07 13:07 UTC

@adulau@infosec.exchange I had once toyed with the idea of grabbing the underlying cipher negotiation features directly via Zeek, vectorizing them, and training up a ML model in lieu of using brittle one-way hashes. I didn't get very far, though. I couldn't find a whole lot in the way of training data, and the impression I had at the time was that nearly everything, including both benign and malicious activity, was converging on the same handful of nearly uniform cipher negotiations due to shared library usage. It might be worth another look, though. I'm curious what @hrbrmstr@mstdn.social thinks.

Replies (1)

@hrbrmstr@mastodon.social 2026-05-07 13:24

@DaveMWilburn@infosec.exchange @adulau@infosec.exchange gosh i have alot to say on this. first, "we" (back at the old place) tried to convince someone to go with constant length vectors vs daft delimited strings. we also noodled (but never implemented) creating vector representations for each of the hashes (not just the TLS one). For reasons I can't blather abt off Signal, we didn't. It is a good idea tho, Dave. There are def other issues. You brought up one (hash convergence b/c of tooling). 1/

Open ##2872961