WebSockets is a protocol that starts over HTTP or HTTPS and then keeps a persistent, two-way connection open between a client and a server. Unlike short request-response traffic, a WebSocket session can stay alive for a long time and send messages in either direction with low overhead. That makes it useful for chat apps, dashboards, live alerts, and other interactive web tools.
In cyber security, WebSockets matter because the same long-lived connection can hide command-and-control traffic inside normal-looking encrypted web activity. Malware can use it to receive instructions, send stolen data, or maintain a stable channel without repeatedly opening new connections. Defenders look for unusual WebSocket use by correlating network logs with endpoint telemetry, such as which process initiated the session, where it connects, and whether the pattern matches the application’s normal behavior. Unexpected WebSocket activity from a browser-like or service process can be a strong hunting clue.