Abstract: A method for characterizing network traffic is provided. The method includes maintaining a database identifying a plurality of digital certificates and a number of Internet Protocol addresses associated with each of the plurality of digital certificates, capturing network traffic over a network connection at a network connected device, analyzing the network traffic by determining the digital certificates associated with Internet Protocol addresses associated with the network traffic and a number of Internet Protocol addresses associated with each of the digital certificates and updating the database, and characterizing at least one of the Internet Protocol addresses associated with one of the digital certificates based on the number of Internet Protocol addresses associated with the one of the digital certificates.

Abstract: A method for characterizing network traffic is provided. The method includes maintaining a database identifying a plurality of digital certificates and a number of Internet Protocol addresses associated with each of the plurality of digital certificates, capturing network traffic over a network connection at a network connected device, analyzing the network traffic by determining the digital certificates associated with Internet Protocol addresses associated with the network traffic and a number of Internet Protocol addresses associated with each of the digital certificates and updating the database, and characterizing at least one of the Internet Protocol addresses associated with one of the digital certificates based on the number of Internet Protocol addresses associated with the one of the digital certificates.

Abstract: A method for detecting malware beaconing in a network is provided. The method includes maintaining a database identifying a plurality of server certificates and a number of Internet Protocol addresses associated with each of the plurality of server certificates, capturing network traffic over a network connection at a network connected device, and analyzing the network traffic by determining SSL and/or TLS server certificates associated with Internet Protocol addresses associated with the network traffic and a number of servers associated with each of the server certificates wherein a greater number of servers associated with a particular one of the server certificates is indicative of less likelihood of malware beaconing. The method may include further analyzing the network traffic to determine malware beaconing, wherein the further analyzing is performed by a computing device.

Abstract: A method for detecting malware beaconing in a network is provided. The method includes maintaining a database identifying a plurality of server certificates and a number of Internet Protocol addresses associated with each of the plurality of server certificates, capturing network traffic over a network connection at a network connected device, and analyzing the network traffic by determining SSL and/or TLS server certificates associated with Internet Protocol addresses associated with the network traffic and a number of servers associated with each of the server certificates wherein a greater number of servers associated with a particular one of the server certificates is indicative of less likelihood of malware beaconing. The method may include further analyzing the network traffic to determine malware beaconing, wherein the further analyzing is performed by a computing device.