aiqbench analysis
This article details a cybersecurity detection capability using Cisco's Encrypted Visibility Engine (EVE) to identify specific malware variants like Flawed AMMYY within encrypted traffic at a conference setting. While the context involves network security and threat intelligence, the core subject matter is the application of advanced session fingerprinting techniques to detect malicious AI-driven or automated botnet activities, which falls under the broader umbrella of machine learning applications in cybersecurity.
Chasing AMMYY at Splunk .conf

Discover how Cisco's Encrypted Visibility Engine (EVE) and Endace PCAP uncovered Flawed AMMYY RAT traffic at Splunk .conf without breaking TLS encryption.
We’ve run the Encrypted Visibility Engine (EVE) in Firewall Threat Defense (FTD) at enough conferences to develop a ‘usual suspects’ list of malware detections. Endpoint connections related to Upatre, Xpiro, and Quasar malware are among the most consistent malware related detections in EVE from conference to conference. The Splunk .conf network brought a new detection that we hadn’t seen before: Flawed AMMYY. AMMYY is a…
Excerpt shown under the publisher's RSS terms · 65 words · full text and figures are on the publisher's site
Related coverage

One Cisco in Action: Inside the Agentic SOC at .conf26
Cisco Blogs · Oct 8, 2026
Trust becomes the product: Five takeaways from the Splunk .conf26 keynotes
ZK Research · Sep 16, 2026

The Zero-Day Blind Spot: Why Your Agentic SOC needs Retrospective Packet Replay
Cisco Blogs · Oct 8, 2026

Admin in the Loop: Firewalls and the Agentic SOC
Cisco Blogs · Oct 8, 2026