Excellent article explaining how malware is increasingly using TLS to thwart introspection and some of the patterns that can be identified in the network.