I'm working on a diploma about finding malware in encrypted TCP traffic and the goal of my project is to create some tool that could block TCP traffic that I would flag as malicious. I have some ideas to recognize malicious traffic based on TCP segments features, but still I have to do whole firewall base for it.

I'm wondering if there is not some existing open-source tool that could help me with this. I'm thinking about some TCP proxy or firewall that would have some features to add self-made scripts to add my own rules that would block specific TCP streams. Something like mitmproxy addons but for TCP packets. I was looking a lot for something like this and found only an academic project PyWall. It's a start but still have some issues that are taking some time to fix.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.