--- title: Live at CyberShock - Data Mining TLS Network Traffic description: On 6 October 2021, Stamus Networks threat researcher and software developer Markus Kont will be giving a talk entitled “Data Mining TLS Network Traffic.” In this talk he will show how simple data mining and statistical analysis can be applied on Suricata TLS and Flow events to identify malware callback beacons to command and control (C2) servers. And we’ll show how TLS JA3S makes this all possible. image: https://www.stamus-networks.com/hubfs/2021%20CyberShock%20-%20Markus-2.jpg --- [![Stamus-Logo-with-R-color-small](https://www.stamus-networks.com/hubfs/Stamus-Logo-with-R-color-small.png "Stamus-Logo-with-R-color-small")](https://www.stamus-networks.com/?hsLang=en) # Live at CyberShock - Data Mining TLS Network Traffic by [Markus Kont](https://www.stamus-networks.com/blog/author/markus-kont) | Sep 27, 2021 | [Events](https://www.stamus-networks.com/blog/tag/events) ![](https://www.stamus-networks.com/hubfs/2021%20CyberShock%20-%20Markus-2.jpg) On 6 October 2021, I’ll be giving a talk entitled “Data Mining TLS Network Traffic.” This is presented as part of [CyberShock 2021](https://cybershock.lv/) and will be streamed live starting at 15:10 (UTC+3). NOTE: A recording of this talk is now available on YouTube. See below # Data Mining TLS Network Traffic Uncovering malware callback beacons - to command and control (C2) servers - by observing traffic in modern networks has a number of challenges. This is because most traffic is encrypted, and traditional IoC signatures are optimized to find known behaviors. In this talk I will show how simple data mining and statistical analysis can be applied on Suricata TLS and Flow events to reveal infrequent TLS servers and connections with periodic patterns. And we’ll show how TLS JA3S makes this all possible. # Background on CyberShock 2021 [CyberShock 2021](https://cybershock.lv) is a strictly technical online cybersecurity conference, which will provide participants with a deep insight into a wide range of cybersecurity related matters, that will be explained by highly prized international experts who will give presentations with the live demo included. The conference is organized by [CERT.LV](https://cert.lv/en) in cooperation with partners [Tet Group](https://www.tet.lv/par-tet/about-us/about-the-company), [Cyber Circle](https://cybercircle.eu/), [Cybexer Technologies](https://cybexer.com/) and [CTF Tech](https://www.ctftech.com/about-us/). Last year's conference gathered more than 700 participants from more than 30 countries. For more information and registration, visit [https://cybershock.lv](https://cybershock.lv/) Please join us if you can. [![Share on facebook](https://7528309.fs1.hubspotusercontent-na1.net/hub/7528309/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/facebook-color.png?width=24&name=facebook-color.png) ](https://www.facebook.com/share.php?u=https%3A%2F%2Fwww.stamus-networks.com%2Fblog%2Fmining-tls-network-traffic%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://7528302.fs1.hubspotusercontent-na1.net/hub/7528302/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/linkedin-color.png?width=24&name=linkedin-color.png) ](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww.stamus-networks.com%2Fblog%2Fmining-tls-network-traffic%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://7528304.fs1.hubspotusercontent-na1.net/hub/7528304/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/twitter-color.png?width=24&name=twitter-color.png) ](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fwww.stamus-networks.com%2Fblog%2Fmining-tls-network-traffic%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fwww.stamus-networks.com%2Fblog%2Fmining-tls-network-traffic%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://7528311.fs1.hubspotusercontent-na1.net/hub/7528311/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/email-color.png?width=24&name=email-color.png) ](mailto:?subject=Check+out+https%3A%2F%2Fwww.stamus-networks.com%2Fblog%2Fmining-tls-network-traffic%3Futm_medium%3Dsocial%26utm_source%3Demail&body=Check+out+https%3A%2F%2Fwww.stamus-networks.com%2Fblog%2Fmining-tls-network-traffic%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Markus Kont](https://www.stamus-networks.com/hubfs/Stamus%202020/Images/icon-user.png) #### Markus Kont Markus is a threat researcher and software engineer at Stamus Networks. In this role, he is focused on threat intelligence, data science and engineering, and backend research and development. Before joining Stamus Networks, Markus spent over 5 years as a technology researcher in the NATO Cooperative Cyber Defense Center of Excellence, where he specialized in monitoring and intrusion detection, and conducted classroom trainings for Suricata and Moloch. Prior to that he worked as a server administrator for Estonian hosting and software development company. Markus holds a Master of Science degree in Cyber Security and has published several academic papers while pursuing a PhD. Markus resides in Tallinn, Estonia. [**](https://www.linkedin.com/in/markus-kont-99544767/) [** ](https://twitter.com/markuskont) ## Schedule a Demo of Clear NDR [![REQUEST A DEMO](https://no-cache.hubspot.com/cta/default/6344338/a3da5fbf-412c-4e3f-a140-f6f33ed8cc5f.png)](https://cta-redirect.hubspot.com/cta/redirect/6344338/a3da5fbf-412c-4e3f-a140-f6f33ed8cc5f) ## Related posts [![Stamus-at-FIC-2025](https://www.stamus-networks.com/hubfs/with%20our%20team%20in%20person%20%281920%20%C3%97%20960%20px%29%20%283%29.png) ](https://www.stamus-networks.com/blog/stamus-at-fic-2025?hsLang=en) ### [Stamus Networks at Forum InCyber – See Clear NDR in Action!](https://www.stamus-networks.com/blog/stamus-at-fic-2025?hsLang=en) **Stamus Networks** will be exhibiting [**Forum InCyber**](https://europe.forum-incyber.com/en/home-en/), one of Europe’s leading cybersecurity events,... [![Stamus Networks at Black Hat Europe](https://www.stamus-networks.com/hubfs/Stamus-Networks-at-BH-Europe-2024-1.jpg) ](https://www.stamus-networks.com/blog/stamus-networks-at-blackhat-europe-2024?hsLang=en) ### [Stamus Networks at Black Hat Europe 2024](https://www.stamus-networks.com/blog/stamus-networks-at-blackhat-europe-2024?hsLang=en) Stamus Networks is excited to return to [Black Hat Europe 2024](https://www.blackhat.com/eu-24/) at Excel London, United Kingdom 9-12... [![Stamus-at-SuriCon2024](https://www.stamus-networks.com/hubfs/SuriCon%20%281%29.png) ](https://www.stamus-networks.com/blog/stamus-networks-at-suricon-2024?hsLang=en) ### [Stamus Networks at Suricon 2024](https://www.stamus-networks.com/blog/stamus-networks-at-suricon-2024?hsLang=en) Each year, [Suricon](https://suricon.net/) attracts visitors from around the world for three days of training and... [![Stamus-Logo-with-R-white](https://www.stamus-networks.com/hs-fs/hubfs/Stamus-Logo-with-R-white.png?width=2000&height=536&name=Stamus-Logo-with-R-white.png "Stamus-Logo-with-R-white")](https://www.stamus-networks.com/?hsLang=en) ABOUT STAMUS® NETWORKS Stamus Networks is the network intelligence foundation for AI-powered security operations and the creator of the Clear NDR® system. Built on Suricata, the world's leading open-source network security engine, Clear NDR transforms raw network traffic into actionable security insights with unmatched transparency, customization, and effectiveness. Designed to close visibility gaps and reduce alert fatigue, Clear NDR is trusted by leading financial institutions, government agencies, and has been battle-tested over ten years in NATO's largest cybersecurity exercises. Stamus Networks empowers security teams with greater control, fewer false positives, faster response times, and a more responsive, open approach than legacy vendors. - [**](https://www.linkedin.com/company/stamus-networks) - [**](https://twitter.com/StamusN/) - [**](https://www.youtube.com/Stamus-Networks) - [* *](https://discord.gg/JUMSU9uA) - Paris, FranceIndianapolis, USA **[contact@stamus-networks.com](mailto:contact@stamus-networks.com) [Privacy](https://www.stamus-networks.com/privacy-policy?hsLang=en) © 2014-2026 Stamus Networks, Inc. All rights Reserved.