The aim of this thesis is to examine the encrypted network traffic generated by malware in recent malware campaigns and to identify any specific characteristics that would allow it to be differentiated from regular encrypted traffic. The student will focus on the protocol SSL/TLS, specifically on the handshake parameters exchanged when the secure connection is established. The scope of malware campaigns is limited only on those aimed (but not exclusively) at operating system Windows. The thesis will include the following steps:

• The student will become acquainted with the problematics of network traffic encryption, focusing on the protocol SSL/TLS.
• Overview of the recent malware campaigns that used encrypted traffic to hide their malicious activity.
• Collecting the traffic samples of the chosen malware in the form of pcap files.
• Analysis of the SSL/TLS handshake parameters used in the captured traffic and comparison with parameters common in the benign encrypted network traffic.

Required output:

• Overview of the malware campaigns with regards to their use of encrypted communication.
• The collected pcaps must be attached. Care should be taken to eliminate as much as possible of the background traffic not connected to malware activity.
• Summary of the analysis and comparison results.

The thesis will be written in English.