Visualising TLS Fingerprints With TMAP To Hunt Malicious Domains

Learn about advanced techniques for detecting malicious domains in this Security BSides London conference talk that explores the evolution of TLS fingerprinting methods. Discover how to enhance domain classification by combining TLS fingerprints with HTTP header data to create a sophisticated similarity mapping system. Explore the application of MinHash and local sensitivity hashing techniques, inspired by chemical fingerprinting methods, to visualize high-dimensional data and identify previously unknown malicious domains. Master innovative approaches to address the growing challenges of tracking and blocking dangerous domains, particularly in light of increasing TLS similarity in Content Delivery Networks (CDNs) and the limitations of traditional fingerprinting techniques like JARM and JA3.