System and method for estimating an amount of acknowledged application data transmitted by encrypted transport

Abstract

A system and computer-implemented method to process bidirectional network traffic having encrypted application data and using an encrypted transport protocol. The method includes estimating a size of encrypted application data in respective packets of the bidirectional network traffic, wherein the packets of the bidirectional network traffic are transported in opposing directions. The method further includes assigning timing criteria to respective application packets transported in the opposing directions that were determined to include a threshold amount of encrypted application data, the timing criteria being based on a time of observation at an observation point of the corresponding application packet, and acknowledging, for respective packets of the application packets, selected application packets that were selected based on the timing criteria assigned to the respective application packets. The method further includes estimating an amount of encrypted application data transported in at least one of the opposing directions based on a sum of the estimated size of the encrypted application data in the respective acknowledged packets transported in the at least one of the opposing directions that were observed during a selected time interval.

Description

FIELD OF THE INVENTION[0001]The present technology relates to network monitoring and, more particularly, methods and systems to estimate an amount f acknowledged application data s by an encrypted transport protocol.BACKGROUND OF THE INVENTION[0002]Network analysis systems analyze data about the amount of application data that has been acknowledged by end points in a network flow. When network traffic is transported using an unencrypted transport protocol, such as transmission control protocol (TCP), information in the packet headers can indicate the amount of application data that has been acknowledged by the end points. For example, information stored in the SEQ and ACK packet headers can provide such information. However, when network traffic is transported using an encrypted transport protocol, without decryption of the packet headers, such information is inaccessible. In many scenarios, decryption is not an option.[0003]Such conventional methods and systems have generally been ...

AI Technical Summary

Problems solved by technology

However, when network traffic is transported using an encrypted transport protocol, without decryption of the packet headers, such information is inaccessible.

In many scenarios, decryption is not an option.

Images