I'm working on a diploma about finding malware in encrypted TCP traffic and the goal of my project is to create some tool that could block TCP traffic that I would flag as malicious. I have some ideas to recognize malicious traffic based on TCP segments features, but still I have to do whole firewall base for it.
I'm wondering if there is not some existing open-source tool that could help me with this. I'm thinking about some TCP proxy or firewall that would have some features to add self-made scripts to add my own rules that would block specific TCP streams. Something like mitmproxy addons but for TCP packets. I was looking a lot for something like this and found only an academic project PyWall. It's a start but still have some issues that are taking some time to fix.