There are techniques to fingerprint TLS connections and identify the client. For example:

http://blog.squarelemon.com/tls-fingerprinting/

This can be used to identify malware which is otherwise hiding itself from the network using TLS.

If the sample pcaps used for this research are available, I would be more than happy to produce fingerprints.