Which of the following AI-driven techniques is used to detect malware in encrypted traffic?

Behavioral analysis, powered by AI and machine learning, is a key technique for detecting threats in encrypted traffic without requiring decryption. Instead of inspecting the payload, this method analyzes metadata and traffic characteristics, such as session duration, data volume, certificate information, client application, and the sequence of connections (e.g., to a command-and-control server). AI models are trained to recognize patterns in this metadata that are indicative of malware, botnets, or other malicious activities, allowing for detection while preserving privacy and performance.

A. Deep Packet Inspection (DPI): Traditional DPI is ineffective on encrypted traffic as it cannot read the encrypted payload where signatures would be found.
C. Static Rule Matching: This technique relies on finding specific, known signatures (hashes, strings) within the data payload, which is impossible with encrypted traffic.
D. Port-Based Filtering: This is a rudimentary method that only checks the communication port (e.g., 443 for HTTPS) and provides no insight into the traffic's content or behavior.

1. Palo Alto Networks. (n.d.). Advanced Threat Prevention. Palo Alto Networks Technology Overviews. Retrieved from https://www.paloaltonetworks.com/network-security/advanced-threat-prevention. Section: "Stop Threats in Encrypted Traffic." "Our inline deep learning models can detect and prevent new C2 threats in encrypted traffic without the need for decryption."

2. Palo Alto Networks. (2023). How Can Machine Learning Stop Unknown Threats?. Palo Alto Networks White Papers. Retrieved from https://www.paloaltonetworks.com/resources/whitepapers/how-can-machine-learning-stop-unknown-threats. Page 4, "Detecting Threats in Encrypted Traffic." "By analyzing session metadata with machine learning, we can identify malicious traffic without decryption."

3. Shabtai, A., et al. (2012). Detection of malicious code by applying machine learning classifiers on static features: A state-of-the-art survey. Information Systems Frontiers, 14(1), 19-43. https://doi.org/10.1007/s10796-010-9289-5. This academic paper discusses the principles of using ML on metadata (static and behavioral features) for malware detection, a concept applicable to encrypted traffic analysis.