Skip to content
aiqbench takeMachine Learning

aiqbench analysis

This article details a cybersecurity detection capability using Cisco's Encrypted Visibility Engine (EVE) to identify specific malware variants like Flawed AMMYY within encrypted traffic at a conference setting. While the context involves network security and threat intelligence, the core subject matter is the application of advanced session fingerprinting techniques to detect malicious AI-driven or automated botnet activities, which falls under the broader umbrella of machine learning applications in cybersecurity.
Source coveringCisco Blogs
What this isA model's reading of the article and related coverage, written for aiqbench. Not the publisher's words.

Chasing AMMYY at Splunk .conf

Cisco Blogs3 min read

Discover how Cisco's Encrypted Visibility Engine (EVE) and Endace PCAP uncovered Flawed AMMYY RAT traffic at Splunk .conf without breaking TLS encryption.

We’ve run the Encrypted Visibility Engine (EVE) in Firewall Threat Defense (FTD) at enough conferences to develop a ‘usual suspects’ list of malware detections. Endpoint connections related to Upatre, Xpiro, and Quasar malware are among the most consistent malware related detections in EVE from conference to conference. The Splunk .conf network brought a new detection that we hadn’t seen before: Flawed AMMYY. AMMYY is a…

Excerpt shown under the publisher's RSS terms · 65 words · full text and figures are on the publisher's site

Related coverage